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On the Front Cover 



The STS-114 patch design signifies the return of the Space Shuttle to flight 
and honors the memory of the STS-107 Columbia crew. The blue Shuttle 
rising above Earth’s horizon includes the Columbia constellation of seven 
stars, echoing the STS-107 patch and commemorating the seven members 
of that mission. The crew of STS-114 will carry the memory of their friends 
on Columbia and the legacy of their mission back into Earth orbit. The 
dominant design element of the STS-114 patch is the planet Earth, which 
represents the unity and dedication of the many people whose efforts allow 
the Space Shuttle to safely return to flight. Against the background of the 
Earth at night, the blue orbit represents the International Space Station 
(ISS), with the EVA crewmembers named on the orbit. The red sun on the 
orbit signifies the contributions of the Japanese Space Agency to the 
mission and to the ISS program. The multi-colored Space Shuttle plume 
represents the broad spectrum of challenges for this mission, including 
Orbiter inspection and repair experiments, and bringing supplies to the 
International Space Station. (Courtesy of NASA) 


On the Title Page 

Discovery heads for the International Space Station during the STS-114 
return-to-flight launch on July 26, 2005. 


On the Back Cover 

The seven stars of the Columbia constellation are in memory of the 
crewmembers lost on STS-107. 
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INTRODUCTION TO THE RETURN TO FLIGHT TASK GROUP 

On February 1, 2003, the Space Shuttle Columbia disintegrated while returning to Earth 
during the STS-107 mission, killing the crew of seven. Within hours, the independent 
Columbia Accident Investigation Board (CAIB) was appointed by the NASA Administrator. 

Determining the most-probable physical cause of the Columbia accident - foam debris from 
the External Tank impacting the reinforced carbon-carbon on the Orbiter wing leading edge - 
was the more-straightforward part of the investigation conducted by the accident board. 
Unlike many accident boards, however, the CAIB elected to delve deeper into the accident 
than simply determining the physical cause. It was obvious to the board very early-on that 
there was an underlying problem with leadership, management, and culture at NASA, and 
specifically within the Space Shuttle Program. Ultimately, the CAIB placed as much weight 
on these causal factors as on the more easily understood and correctable physical cause of the 
accident. 

The CAIB released the first volume of its final report on August 26, 2003, containing 29 
specific recommendations and numerous findings and observations for changes to the vehicle, 
to the Space Shuttle Program, and to NASA in general. Among those recommendations were 
15 that the accident board believed should be implemented prior to returning the Space 
Shuttle to flight. 

On April 14, 2003, then-NASA-Administrator Sean O’Keefe wrote Lt. Gen. Thomas P. 
Stafford, U.S. Air Force (Ret.), requesting that the Stafford Task Force on International Space 
Station Operational Readiness undertake an assessment of NASA’s plans to return the Space 
Shuttle to flight. The Stafford Task Force is a standing body chartered by the NASA Advisory 
Council, an independent advisory group to the NASA Administrator. 

One month later, Lt. Gen. Stafford responded to the Administrator with a plan to activate a 
sub-organization with Col. Richard O. Covey, U.S. Air Force (Ret.), leading the day-to-day 
effort of conducting an independent assessment of the 15 CAIB return-to-flight 
recommendations. As a result, on July 18, 2003, a Return to Flight Task Group (RTF TG, or 
simply, the Task Group) was chartered under the Federal Advisory Committee Act (Public 
Law 92-463, as amended) with Lt. Gen. Stafford and Col. Covey as co-chairs. 

Over the past two years, using expertise from academia, aerospace industry, the federal 
government, and the military, the RTF TG assessed the actions taken by NASA to implement 
the 15 CAIB return-to-flight recommendations plus one additional item the Space Shuttle 
Program assigned to itself as a “raising the bar” action. During this time the Task Group 
conducted fact-finding activities, reviewed documentation, held public meetings, reported the 
status of its assessments to the Space Flight Leadership Council, and released three interim 
reports. The assessments of the Task Group, although based primarily on data provided by the 
Space Shuttle Program, were independent of that program and were intended to provide the 
NASA Administrator an evaluation of the progress NASA made toward meeting the intent of 
the CAIB recommendations. 

The Task Group completed their last assessments on June 27, 2005; this report does not 
contain data released after that date (excepting a few photographs). Although this report is 
being released after the landing of STS-114, pertinent information contained herein was 
briefed to the appropriate NASA officials prior to the launch of STS-114. 

As the Task Group delivers this final report to the NASA Administrator, Congress, and the 
American public, we take this opportunity to emphasize that this report is strictly advisory. 
Only NASA can, and should, make the determination if the vehicle, supporting infrastructure, 
and management organization are sufficiently robust to continue flying. 
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Discovery, as 
STS-114, rolls out 
of the Vehicle 
Assembly Building at 
the Kennedy Space 
Center on her way to 
Launch Complex 
39B for the first flight 
of a Space Shuttle 
since the loss of 
Columbia on 
February 1,2003. 
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ORGANIZATION OF THE RTF TG FINAL REPORT 

This final report is organized into an executive summary, six numbered sections, various 
appendices, and one annex. 

The Executive Summary provides an overview of the efforts by NASA toward implementing 
the return-to-flight recommendations of the Columbia Accident Investigation Board (CAIB) 
and a summary of the Task Group’s assessments of each. Also included is an assessment of a 
“raising the bar” action that the Space Shuttle Program assigned to itself above and beyond 
the CAIB recommendations. The Executive Summary was delivered to the NASA 
Administrator and posted on the RTF TG website on June 28, 2005; however, the version 
contained herein has been slightly edited without affecting its content. 

Section 1 is a short, general introduction to the Space Shuttle Program and its current place in 
the Agency’s long-term plans. 

Section 2 attempts to show the interrelationships among the various recommendations since, 
in many cases, the implementation and assessment crossed multiple CAIB recommendations. 
This section also contains an assessment from the Task Group’s Integrated Vehicle 
Assessment Sub-Panel that cuts across several recommendations. 

Section 3 is the Task Group’s formal assessment of each of the CAIB return-to-flight 
recommendations, in numerical order. First, the original language of the CAIB 
recommendation is provided, followed by the Task Group’s interpretation of that 
recommendation. Next is any relevant background information that might assist the reader in 
understanding the recommendation. This is followed by an explanation of the steps NASA 
took to implement the recommendation. For the most part, the NASA implementation comes 
from NASA’s Implementation Plan for Space Shuttle Return to Flight and Beyond , using 
whatever edition was current on the date the Task Group deliberated closing their assessment. 
Additional information from the closure packages submitted by NASA, requests for 
information, and fact-finding activities are also included as necessary to ensure an adequate 
description. This is followed by the Task Group’s assessment of the Agency’s progress up to 
the date of the deliberation, and the final status of the assessment. Observations and minority 
views, if any, regarding a particular recommendation follow the assessment. 

Section 4 describes open work the RTF TG will transition to the Aerospace Safety Advisory 
Panel (ASAP) or other appropriate organizations. 

Section 5 introduces the Task Group, its function, the members, and the staff who supported 
it. Also discussed is the organization of the Task Group, a bit of its history and changes in 
personnel, policies, procedures, and processes, and a brief summary of the three interim 
reports issued by the Task Group prior to this final report. 

Section 6 provides a summary of the 11 plenary meetings of the Task Group. This gives a 
brief insight into the progress made along the way to this final report. 

Various appendices contain the charter, short biographies of the members, a list of the staff 
who supported the Task Group, dates of fact-finding activities, and an acronym list. 

Annex A contains a set of observations by individual Task Group members that are provided 
to assist the NASA Administrator in understanding any issues or other items they may have 
observed during the assessments. This section allows members of the Task Group an 
opportunity to make “observations on safety or operational readiness” as allowed by the RTF 
TG charter. 
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Discovery lingers at 
the foot of Launch 
Complex 39B in the 
evening twilight on 
April 6, 2005. The 
Space Shuttle sits 
atop a Mobile 
Launcher Platform 
transported on top of 
a Crawler- 
Transporter. (NASA 
photo courtesy of 
Scott Andrews) 
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EXECUTIVE SUMMARY 

It has been 29 months since Columbia was lost over East Texas in February 2003. Seven 
months after the accident, the Columbia Accident Investigation Board (CAIB) released the 
first volume of its final report, citing a variety of technical, managerial, and cultural issues 
within NASA and the Space Shuttle Program. To their credit, NASA offered few excuses, 
embraced the report, and set about correcting the deficiencies noted by the accident board. Of 
the 29 recommendations issued by the CAIB, 15 were deemed critical enough that the 
accident board believed they should be implemented prior to returning the Space Shuttle to 
flight. Some of these recommendations were relatively easy, most were straightforward, a few 
bordered on the impossible, and others were largely overcome by events, particularly the 
decision by the President to retire the Space Shuttle by 2010. 

The Return to Flight Task Group (RTF TG, or simply, the Task Group) was chartered by the 
NASA Administrator in July 2003 to provide an independent assessment of the 
implementation of the 15 CAIB return-to-flight recommendations. An important observation 
must be stated up-front: neither the CAIB nor the RTF TG believes that all risk can be 
eliminated from Space Shuttle operations; nor do we believe that the Space Shuttle is 
inherently unsafe. What the CAIB and RTF TG do believe, however, is that NASA and the 
American public need to understand the risks associated with space travel, and that NASA 
must make every reasonable effort to minimize such risk. 

Since the release of the CAIB report, NASA and the Space Shuttle Program expended 
enormous effort and resources toward correcting the causes of the accident and preparing to 
fly again. Relative to the 15 specific recommendations that the CAIB indicated should be 
implemented prior to returning to flight, NASA has met or exceeded most of them - the Task 
Group believes that NASA met the intent of the CAIB for 12 of these recommendations. The 
remaining three recommendations were so challenging that NASA could not comply 
completely with the intent of the CAIB, but conducted extensive study, analyses, and 
hardware modifications that resulted in substantive progress toward making the vehicle safer. 
It must be emphasized, however, that, the inability to fully comply with all of the CAIB 
recommendations does not imply that the Space Shuttle is unsafe. 



Workers in the 
Launch Control 
Center at the 
Kennedy Space 
Center watch 
Discovery during her 
slow trip to LC-39B. 
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Although the scorecard is impressive, it alone does not tell the complete story. The Task 
Group applauds NASA for its efforts, but urges continued vigilance is required to prevent 
another accident. Spaceflight is a demanding pursuit, and the President, Congress, NASA, and 
the American public must provide the proper resources and environment to ensure it is 
conducted in the safest and most efficient manner possible. 

It is important to reiterate: the NASA Administrator and his staff - not the CAIB or the RTF 
TG - will ultimately determine if the remaining risk is sufficiently low to allow the Space 
Shuttle to continue flying. The Task Group cannot, and will not, make a determination of the 
safety or reliability of the next flight; that is NASA’s responsibility. 

On the hardware side, Solid Rocket Booster Bolt Catcher was redesigned in order to qualify it 
to existing requirements. Numerous changes have been made to reduce debris shedding from 
the External Tank. The ET has been modified to eliminate the bipod ramp foam that was the 
physical cause of the Columbia accident. The procedures for manual application of foam 
insulation have been changed to include greater process control and quality inspection. Much 
has been learned about foam and ice and what causes them to shed from the External Tank 
during ascent. Heaters have been added to areas of the External Tank to impede the formation 
of ice, and various other flaws in the design and manufacture of the tank were discovered and 
corrected along the way. Nevertheless, despite diligent work, it has proven impossible to 
completely eliminate debris shedding from the External Tank. The hard fact of the matter is 
that the External Tank will always shed debris, perhaps even pieces large enough to do critical 
damage to the Orbiter. 


Before a group of 
photographers, 
Discovery is hoisted 
into a vertical 
position in the 
transfer aisle of the 
Vehicle Assembly 
Building at the 
Kennedy Space 
Center. After this the 
Orbiter was lifted into 
a High Bay to be 
mated with a waiting 
set of Solid Rocket 
Boosters and an 
External Tank. 
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Prior to the Columbia accident, surprisingly little was known about the actual impact 
resistance of the Orbiter Thermal Protection System, especially the Reinforced Carbon- 
Carbon (RCC) that is used on the wing leading edges and nosecap. A great deal of effort - 
using both theoretical analysis and physical testing - has been expended over the past two 
years to quantify the durability and strength of the Orbiter Thermal Protection System, 
particularly its ability to withstand debris impacts. However, because of the limited amount of 
time remaining before the Space Shuttle fleet is retired, NASA has chosen to implement only 
a limited number of improvements to harden the Orbiter to withstand debris strikes. 

It was therefore prudent to develop a capability to repair damage to the Orbiter before entry; a 
similar effort was cancelled in 1980 when it became apparent that it was unlikely to produce 
any meaningful results prior to the first flight of Columbia in 1981. Unfortunately, repairing 
damage to the Orbiter Thermal Protection System again proved to be technically challenging 
almost to the point of impossibility. The Thermal Protection System was not designed to be 
repaired on-orbit, and virtually every approach developed thus far has serious limitations. 
While work will continue, it is likely that only very limited on-orbit repairs will be possible 
for the remaining flights of the Space Shuttle. 

The last resort, if debris does again cripple an Orbiter, is to provide a safe haven capability 
aboard the International Space Station where a Space Shuttle crew can await a rescue vehicle. 
NASA has made good progress in identifying the challenges associated with this concept, and 
the Task Group feels that a workable solution is in hand, although using it will certainly mean 
the end of the Space Shuttle Program, and very possibly the International Space Station 
Program also. Additionally, this capability is only planned for STS-114 and STS-121. 

Along with the changes to the External Tank and Orbiter, NASA has implemented a host of 
improvements to the infrastructure and tools available to the Space Shuttle Program. 
Improved ground-based cameras will track the Space Shuttle during ascent, as will airborne 
cameras mounted on WB-57 aircraft. New cameras and instrumentation have been installed 
on the External Tank, Solid Rocket Boosters, and Orbiter. Agreements to use National assets 
are in place, and instruments on the International Space Station and the newly-installed 
Orbiter Boom Sensor System will inspect the Orbiter for damage. Dozens of new analytical 
models attempt to explain debris shedding, debris transport methods, and potential damage. 

The CAIB went beyond the technical issues that were the physical cause of the Columbia 
accident and cited “management” and “culture” shortcomings as equally culpable. Therefore, 
the accident board made a number of recommendations for changes to how the Agency, 
especially the Space Shuttle Program, functions. 

The Task Group feels that NASA has met the intent of the CAIB management 
recommendations, although all of them remain works in progress. The establishment of an 
Independent Technical Authority within the Chief Engineer’s office moves technical 
requirements out of the direct control of the Space Shuttle Program management chain. This 
provides a check-and-balance when it becomes necessary to approve waivers or deviations to 
a technical requirement, since the Independent Technical Authority is not constrained by 
budget or schedule pressures that may be present within the program. Although initiated prior 
to the release of the CAIB report, the establishment of the NASA Engineering and Safety 
Center (NESC) has created an independent body that provides technical assessments across 
the Agency. A restructured Safety and Mission Assurance (SMA) organization increases the 
independence of SMA personnel. Reorganizing the systems engineering and systems 
integration activities within the Space Shuttle Program clears up several ambiguities that led 
to confused communications between elements. 

The Mission Management Team (MMT), much maligned by the CAIB, has been reconstituted 
and has undergone extensive training, with multiple simulations of alternative scenarios, 
including consideration of the use of the International Space Station as a safe haven for the 
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crew of a damaged Orbiter, and the launch of a rescue mission. Refurbished facilities for the 
MMT provide a more conducive environment for their deliberations during each flight. It 
appears to the Task Group that the changes to the MMT have revitalized this group, but we 
stress that NASA must not allow this capability to atrophy as it had prior to the Columbia 
accident. 

Publicly, NASA has said that the first two return-to-flight missions are “test flights” to assess 
the performance of the modified External Tank and to evaluate repair materials and 
techniques on orbit. In reality, however, the flights are planned as much for servicing the 
International Space Station as for testing. NASA intends to carefully monitor the performance 
and condition of the Space Shuttle during these two flights. For example, the launch rules 
require specific daylight conditions at the Kennedy Space Center and during External Tank 
separation to facilitate detailed imagery of the Orbiter and External Tank. 

Risk acceptance and management are fundamental to leadership in hazardous technical 
activities and are the ultimate responsibility of any leader. Very few human endeavors, 
particularly related to high-energy activities involving advanced technologies, are completely 
free of risk. Space flight in general, and human space flight in particular, is such that it is 
impossible to drive the risk to zero. While the return-to-flight efforts have eliminated or 
minimized many known risks, Space Shuttle missions will always be “accepted risk” 
operations. This requires that the people involved understand, document, and ultimately 
accept the risk associated with that activity. NASA must be vigilant to prevent the 
development of a false sense of security by accepting faulty assumptions, or otherwise 
inappropriate analyses, to justify return to flight and continued Space Shuttle operations. 

As the CAIB opined, “NASA is a federal agency like no other. Its mission is unique, and its 
stunning technological accomplishments, a source of pride and inspiration without equal, 
represent the best in American skill and courage. At times NASA’s efforts have riveted a 
nation, and it is never far from public view and close scrutiny from many quarters.” With this 
in mind, the Task Group believes that NASA must always strive for the highest level of 
accomplishment, to exceed the expectations of the Nation, and to do what is right, despite 
easier options that may present themselves. 

Assessment Summaries 

Listed in numerical order, this is a summary of the Task Group assessments of the Agency’s 
implementation of the 15 CAIB return-to-flight recommendations. More detail may be found 
in other sections of this report. 

CAIB Recommendation 3.2-1: External Tank Debris Shedding. The physical cause of the 
loss of Columbia and its crew was a breach in the Reinforced Carbon-Carbon on the leading 
edge of the left wing. This was the result of an impact by a piece of insulating foam that 
separated from the left bipod ramp section of the External Tank. During entry this breach 
allowed superheated air to penetrate through the leading edge insulation and progressively 
melt the aluminum structure of the left wing, resulting in a weakening of the structure until 
increasing aerodynamic forces caused loss of control, failure of the wing, and the break-up of 
the Orbiter. To prevent a recurrence, the CAIB wrote this recommendation to initiate an 
aggressive program to eliminate all debris shedding from the External Tank. 

Unfortunately, it has proven impractical to eliminate all debris shedding from the External 
Tank. Therefore, NASA went to extensive lengths to better understand the debris environment 
and the amount of impacts the Orbiter could tolerate without critical damage. Most efforts 
were ultimately focused on achieving a balance between the debris shed by the ET and the 
ability of the Orbiter to tolerate the debris. 
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The Agency and its contractors modified the External Tank to eliminate the bipod ramp foam 
that was the physical cause of the Columbia accident. The processes for manual application of 
foam insulation have been changed to include greater process control and quality inspection. 
An extensive effort has resulted in a new understanding of foam and ice and what causes them 
to shed from the tank during ascent. Heaters have been added to areas of the External Tank to 
impede the formation of ice, and various other flaws in the design and manufacture of the tank 
were discovered and corrected along the way. 

The RTF TG concluded that NASA did not meet the intent of CAIB Recommendation 3.2-1. 
Despite a great deal of excellent work on the part of the Agency and its contractors, the 
External Tank still sheds debris that could potentially cripple an Orbiter. The extensive work 
to develop debris models and transport analysis was, until recently, hampered by a lack of 
rigor in both development and testing. The debris-allowable requirements provided to the ET 
Project did not match what was later determined to be the impact tolerance of the Orbiter. 
That being said, the Task Group believes that the ET Project worked diligently to successfully 
meet the requirements they were provided; unfortunately, those requirements were later 
determined to be inadequate. 

CAIB Recommendation 3.3-1: Reinforced Carbon-Carbon Non-Destructive Inspection. 

The accident board was surprised at how little was known about the impact resistance and 
effects of aging on the Reinforced Carbon-Carbon used as part of the Orbiter Thermal 
Protection System. They recommended that NASA re-baseline all of the RCC components on 
each remaining Orbiter and also take advantage of advanced non-destructive inspection 
technology that was not available when the Space Shuttle Program began. 

The RTF TG concluded that NASA met the intent of CAIB Recommendation 3.3-1 after the 
Agency removed all nosecap, chin panel, and wing leading edge RCC from each of the 
Orbiters and returned them to the manufacturer for evaluation. Testing methods used by the 
manufacturer included the same evaluations done during the original acceptance testing, as 
well as new technologies. It should be noted that this action did not physically change the 
condition of the Orbiter. 

CAIB Recommendation 3.3-2: Orbiter Hardening. The Columbia accident clearly 
demonstrated that the Orbiter Thermal Protection System, including the Reinforced Carbon- 
Carbon panels and acreage tiles, was vulnerable to impact damage from the existing debris 
environment. 

The RTF TG concluded that despite tremendous effort by NASA and its contractors, the 
Agency did not fully meet the intent of CAIB Recommendation 3.3-2, due to the present lack 
of a long-term approach to RCC hardening and the amount of remaining non-standard work 
coming out of the various design verification reviews. An early long-term plan for Orbiter 
hardening was abandoned after the National Policy decision to retire the Space Shuttle fleet 
no later than 2010. Nevertheless, through an extensive test and analysis effort, the Agency has 
learned a great deal about the impact resistance of the Orbiter and has better defined damage 
criteria. NASA has provided some increased hardening through hardware changes, but the 
Orbiter is still vulnerable to the debris environment created by the External Tank. The Space 
Shuttle Program has acknowledged the possibility of critical debris damage and has 
developed an accepted risk rationale. 

CAIB Recommendation 3.4-1: Ground-Based Imagery. The Columbia post-accident 
investigation was hampered by the lack of high-resolution imagery of the vehicle during 
ascent. The CAIB was concerned about the need to have an adequate number of appropriately 
located cameras that operated properly to provide photographic coverage of the Space Shuttle 
from launch through separation of the Solid Rocket Boosters. 

The RTF TG concluded that NASA met the intent of CAIB Recommendation 3.4-1 by 
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increasing the number and capability of ground camera assets. Also, the Agency has arranged 
for airborne assets to mitigate the effects of cloud cover and improve higher altitude 
resolution, at least for the first two launches. From a hardware asset perspective, these 
changes should ensure an adequate capability to provide three useful views. 

CAIB Recommendation 3.4-2: High-Resolution Images of External Tank. Although the 
Space Shuttle Program routinely attempted to photograph the External Tank after separation 
using hand-held cameras on the flight deck and film cameras in the Orbiter umbilical wells, 
none of these images were downlinked to the ground, and the STS-107 images were therefore 
unavailable to the CAIB. The accident board recommended that high-resolution imagery of 
the ET be obtained on each flight and downlinked to the ground as soon as practical after 
achieving orbit. 

The RTF TG concluded that NASA met the intent of CAIB Recommendation 3.4-2 by 
planning to use handheld camera images taken from the Orbiter flight deck and the addition of 
a digital umbilical well camera. The images from these cameras will be downlinked for 
evaluation during the first days on orbit. 

CAIB Recommendation 3.4-3: High-Resolution Images of Orbiter. This was a concern to 
the CAIB because their investigation was hampered by the lack of high-resolution images. 
The accident board recommended that NASA provide a capability to obtain and downlink 
high-resolution images of the underside of the Orbiter wing leading edge and the forward 
portion of the Thermal Protection System tiles under both wings. 

The RTF TG concluded that NASA met the intent of CAIB Recommendation 3.4-3 through 
the addition of the Orbiter Boom Sensor System (OBSS) with two sensor packages and the 
R-Bar Pitch Maneuver(RPM) imagery from the ISS. A full scan of the wing leading edge and 
nosecap will be accomplished by OBSS on Flight Day 2 with the capability for specific, 
detailed inspections on later flight days. Additional imagery is provided through several 
cameras on the External Tank and Solid Rocket Boosters. The Task Group cautions, however, 
this on-vehicle imagery suite does not provide complete imagery of the underside of the 
Orbiter or guarantee detection of all potential impacts to the Orbiter. 

CAIB Recommendation 4.2-1: Solid Rocket Booster Bolt Catcher. While investigating the 
cause of the Columbia accident, the CAIB noted that the Solid Rocket Booster bolt catchers 
had not been properly flight-qualified. Each SRB is connected to the External Tank by four 
separation bolts: three at the bottom plus a larger one at the top that weighs approximately 65 

pounds. Bolt catchers cover each bolt to capture the pieces after the bolt is explosively 

separated during staging. Static and dynamic testing, conducted as a result of the accident 
board’s inquiries, demonstrated that the bolt catchers flown on STS-107 had a factor of safety 
of 0.956, rather than 1.4 required by specification. 

The RTF TG concluded that NASA has gone well beyond the intent of the CAIB in 

answering CAIB Recommendation 4.2-1. Instead of simply qualifying the existing bolt 

catchers, NASA undertook an extensive redesign, and then qualified the new design. 

CAIB Recommendation 4.2-3: Two Person Closeout Inspections. While reviewing various 
security aspects of the Space Shuttle Program to eliminate terrorist activity or sabotage as 
possible causes of the Columbia accident, the CAIB noted a lapse in procedures at various 
NASA installations. There were several processes that did not require two people to be 
present when an area on the flight vehicle was closed-out (sealed prior to flight). Although 
unlikely, this could allow an individual to sabotage the vehicle without being observed, and 
was also against the general policy of “two sets of eyes are better than one” that provides 
additional technical and safety checks during closeouts. It is important to note, however, that 
the CAIB found no evidence that willful damage was a cause of the accident (Finding 4.2-12). 
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The RTF TG concluded that NASA had met the intent of CAIB Recommendation 4.2-3 
through revised procedures at all locations that now require at least two people to be present 
during a closeout. 

CAIB Recommendation 4.2-5: Kennedy Space Center Foreign Object Debris Definition. 

During January 2001 the Kennedy Space Center generated new and non-standard definitions 
for Foreign Object Debris (FOD). The term “processing debris” was applied to debris found 
during the routine processing of the flight hardware. The term FOD applied only to debris 
found in flight hardware after final closeout inspections. These definitions were unique to the 
Space Shuttle Program at KSC. Because debris of any kind has critical safety implications, 
the CAIB wanted the standard, industry-wide definition reestablished for FOD. 

The RTF TG concluded that NASA met the intent of CAIB Recommendation 4.2-5 when 
KSC and the United Space Alliance changed the definition of “Foreign Object Debris” to be 
consistent with the recognized and accepted industry standard. Further, the Agency has 
removed the misleading category of processing debris that caused concern. They have 
improved the training of the workforce and implemented several improvements above and 
beyond the expectations defined in the CAIB recommendation. 

CAIB Recommendation 6.2-1: Consistency with Resources. The CAIB explicitly 
recognized the legitimate use of schedules to drive a process, but was concerned, however, 
that the line between “beneficial” schedule pressures and those that become detrimental 
cannot be defined or measured. In the case of Columbia , the CAIB discovered that pressure 
on the Space Shuttle Program was created by the schedule for construction of the 
International Space Station. Indeed, the planned February 2004 completion of Node 2 of the 
ISS was being touted as a measure of NASA’s ability to maintain a schedule that had been 
promised to Congress. 

The RTF TG concluded that NASA met the intent of CAIB Recommendation 6.2-1, since 
new tools and processes put in place by the Agency should preclude this type of undue 
schedule pressure in the future. The Task Group cautions, however, that resource sufficiency 
is also tied to the scheduled retirement date for the Space Shuttle. Any evaluation of plans to 
keep the Space Shuttle in service past 2010 should include a reassessment of actions and 
upgrades not undertaken by NASA, and any long-term items already deleted from work and 
acquisition cycles, including the Service Life Extension Program. 

CAIB Recommendation 6.3-1: Mission Management Team Improvements. The 

performance of the Mission Management Team (MMT) during the flight of Columbia has 
been widely criticized. Many of the additional capabilities embedded in other 
recommendations from the CAIB, such as imagery from various sources and vehicle damage 
tolerance maps, are intended to support MMT activities for the return to flight. The CAIB 
recommended that the MMT receive additional training to deal with potential crew and 
vehicle safety contingencies beyond the launch and ascent phases of flight. 

The RTF TG concluded that NASA has met the intent of CAIB Recommendation 6.3-1 by 
developing a new training plan for the MMT. With the passage of time, the Task Group has 
been able to observe the implementation of most aspects of the plan. Numerous simulations 
have been conducted, including more than 10 involving live, face-to-face exercises of various 
parts of the next mission. The various delays in launching STS-114 have allowed the MMT to 
further refine its procedures and have resulted in continual improvement. The Mission 
Management Team has made notable progress in addressing the CAIB concerns, and the 
Agency has demonstrated a commitment to continual MMT improvement. 

CAIB Recommendation 6.3-2: National Imagery and Mapping Agency Memorandum of 
Agreement. There was considerable public discussion of the decision during the flight of 
Columbia to forego requesting the assistance of other federal agencies in assessing the 
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condition of the Orbiter, including any possible damage. The CAIB wanted the Space Shuttle 
Program to have the procedures in place to get all possible data to investigate a potential 
problem. This included having the proper personnel maintain the appropriate security 
clearances to access data from National assets. 

The RTF TG has concluded that NASA has met the intent of CAIB Recommendation 6.3-2. A 
revised Memorandum of Agreement is in place between NASA and the National Geospatial- 
Intelligence Agency (NGA - the successor to NIMA), and appropriate security clearances 
have been obtained by various NASA personnel. The coordination required to use this 
capability has also been exercised in various MMT simulations. 

CAIB Recommendation 6.4-1: Thermal Protection System Inspection and Repair. This 
was a four-part CAIB recommendation. The RTF TG only assessed the parts of this 
recommendation applicable to inspection and repair for the return-to-flight effort. 

After long and often spirited discussion, the RTF TG concluded that NASA did not meet the 
intent of CAIB Recommendation 6.4-1 relative to repair of the Orbiter Thermal Protection 
System; the inspection part included in the assessment of Recommendation 3.4-3 did meet the 
intent of CAIB. The basic debate within the Task Group was more one of process than of fact; 
everybody agrees that the repair options on STS-114 “are what they are.” The Task Group 
opinion - by a slim margin - was that each of the repair options that comprise the repair 
capability must be sufficiently tested and vetted so that NASA could implement it in an 
emergency situation with confidence that it would perform as expected. To date, the tile and 
RCC repair techniques developed by the Agency are not considered sufficiently mature to be 
a practicable repair capability for STS-114. 

CAIB Recommendation 9.1-1: Detailed Plan for Organizational Change. The CAIB 
expected NASA to return to flight relatively quickly, and the accident board did not want to 
restrict this activity by requiring major organizational changes. Instead, the CAIB wrote a 
separate recommendation that NASA produce a detailed plan to implement the organizational 
changes embodied in three other recommendations - R7.5-1, Independent Technical 
Authority; R7.5-2, Safety and Mission Assurance; and R7.5-3, Systems Engineering and 
Integration. However, getting ready for the first retum-to-flight mission took much longer 
than initially expected, allowing NASA to proceed with many of the organizational changes 
recommended by the CAIB. The Task Group elected to assess the actual changes, in addition 
to the plan. 

The Task Group believes that embodied in Recommendation 9.1-1, however, are a myriad of 
organizational and management issues raised by the CAIB, including “culture.” The CAIB 
used the term “culture” throughout its report, although there are neither specific 
recommendations to change culture nor any suggestions on how this might be accomplished. 
Therefore, organizational culture, although important, was not considered a retum-to-flight 
issue and was not evaluated by the Task Group. 

The RTF TG concluded that NASA has met the intent of CAIB Recommendation 9.1-1 
because the Agency has a mature plan to restmcture the organization as envisioned by the 
accident board. The assessment of the actual changes, however, is mixed. The planned 
implementation of the Independent Technical Authority comports with CAIB intent, but 
resistance to this formulation still exists - it will take time to see if the process is robust 
enough to overcome the internal opposition. The planned response to R7.5-2 is intentionally 
not consistent with the CAIB recommendation - NASA simply disagrees that the best 
organization is for the field centers’ Safety and Mission Assurance Offices to report directly 
to Headquarters; the Task Group is sympathetic to the NASA position. Implementation of 
R7.5-3 is uneven, with improved integration and system analysis but with some worrisome 
gaps in system engineering capability. 
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CAIB Recommendation 10.3-1: Digitize Closeout Photos. During the Columbia 
investigation, the accident board encountered numerous engineering drawings that were 
inaccurate. Further, they discovered that a large number of engineering change orders had not 
been incorporated into the drawings. Tied in with this, in many instances CAIB investigators 
were not able to access needed closeout photography for several weeks. 

The RTF TG has concluded that NASA has met the intent of CAIB Recommendation 10.3-1. 
Standardized 6.1-megapixel cameras have been acquired for use in closeout and configuration 
photography. NASA identified enhancements to the Shuttle Image Management System 
(SIMS) database, and necessary upgrades are complete. Updated training material has been 
developed for users of the SIMS database, and users have received training at KSC, JSC, and 
MSFC. Through several integrated launch countdown simulations, the Space Shuttle Program 
staff have confirmed that the modifications to the SIMS database satisfy their needs. 

The CAIB recommendation assumed that the Space Shuttle Program would continue for the 
long term, and it indicated that the digital photography should be an interim solution pending 
the digitizing and updating of all Space Shuttle engineering drawings (R 10.3-2). However, 
based on the decision to retire the Space Shuttle no later than 2010, the Task Group concurs 
with NASA’s decision that it does not make economic sense to expend the resources to make 
major changes in the drawings. The digital closeout photography provides an adequate 
solution until the end of the program. The Task Group cautions, however, that should the 
decision be made to extend the Space Shuttle Program past 2010 - or to use elements of it for 
a new heavy-lift vehicle - the appropriate engineering drawings should be resolved. 

Raising the Bar Action SSP-3: Contingency Shuttle Crew Support. The CAIB report 
mentioned the feasibility of providing contingency life support on board the International 
Space Station for stranded Space Shuttle crewmembers until repair or rescue could be 
accomplished. The accident board, however, did not issue a specific recommendation to either 
evaluate or implement such a capability. As part of the return to flight efforts, NASA 
developed a capability called Contingency Shuttle Crew Support aboard the ISS for STS-114 
and STS-121. Since this capability was an option of last-resort in several scenarios evaluated 
by the RTF TG, the Task Group elected to evaluate the capability as part of this report. 

The RTF TG concluded that NASA has developed analyses and plans for CSCS which will 
offer a viable emergency capability for crew rescue. NASA set a raising the bar action and 
exceeded it by a significant margin. The Task Group commends NASA for excellent work on 
SSP-3. 

Integrated Vehicle Assessment. To assess the ability to perform an integrated vehicle 
external damage assessment, the RTF TG established the Integrated Vehicle Assessment Sub- 
Panel (IVASP). With the addition of new cameras and sensors, NASA needed a method to 
capture and integrate the information gained from these sensors, use that information to 
perform a damage assessment, and present that information in a way that supported critical 
decision-making regarding potential damage and options to mitigate that damage. 

Beginning from scratch, NASA has developed a process that holds the promise of integrating 
a variety of new and disparate types of data into information that can support these complex 
decisions during flight. They have documented these processes, vetted them, trained to them, 
and revised them accordingly. As we have said, NASA needs an ability to manage risk during 
flight; NASA’s processes to integrate these sensor data into information that can support 
damage assessments represent a significant step in that direction. 

The Task Group commends NASA for its progress in this area and recommends that this work 
continue after STS-114. We further suggest that this process could even serve as a model for 
other cross-NASA integration projects. 
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Concluding Thought 

To focus solely on the CAIB retum-to-flight recommendations as a measure of the safety of 
STS-114 is inappropriate. The Task Group, while concluding that three recommendations 
were not fulfilled in their entirety, was not chartered to reach any conclusion regarding the 
safety of the next flight. Indeed, addressing the CAIB recommendations has been only a part 
of the Agency’s vast work leading to return to flight. It is improper to calculate, on the basis 
of the Task Group’s assessments, the likelihood of success for the next and subsequent flights. 
It is the responsibility of NASA, and only NASA, to define and accept the remaining risk for 
STS-114 and all subsequent missions. 

The Columbia Accident Investigation Board provided a valuable service to the Columbia 
families, NASA, and the Nation by determining the cause of the accident and prescribing 
steps to reduce the risk for subsequent flights. As with most accident boards, the CAIB set a 
high standard, perhaps one that was not achievable given the technology, funding, and 
schedule available to the Space Shuttle Program. Not everything the CAIB recommended 
could be accomplished, but this does not reflect poorly on the dedication or capabilities of the 
NASA workforce. The work accomplished since February 2003 has led to an improved 
vehicle and an enhanced understanding of its capabilities and limitations. In addition, NASA 
has begun to address organizational changes that should clarify lines of communication and 
responsibilities to provide an enhanced safety culture. Perhaps the most important lesson from 
the accident is a renewed respect for the risks inherent in space travel and the need to 
continually monitor and assess those risks. 


Discovery sits at 
Launch Complex 
39B at the Kennedy 
Space Center 
awaiting launch as 
STS-114. 
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1 BACKGROUND 

It has been 24 years since the first launch of Columbia marked the beginning of the Space 
Shuttle Program’s flight phase. During the course of 113 missions, the program suffered two 
tragic flight accidents, costing the lives of 14 astronauts. Despite this, the Space Shuttle is the 
most reliable human spacecraft ever built; reports of it being inherently unsafe do not fully 
take into account the physics or technology involved in boosting a payload off the surface of 
the Earth. 

Space, by its nature, is a hostile environment posing unique risks for any undertaking, 
especially those involving humans. The speeds, pressures, temperatures, and stresses involved 
in space flight are unparalleled in the normal Earth-bound environment in which we all live. 
There are other environments in which humans operate - in the deep sea, for instance - that 
are equally as harsh, at least in some respects, but none are as unforgiving as space flight. 

Everybody involved with the Space Shuttle Program strives - as they should, and must - for 
perfection. But all understand that despite their best efforts, it is highly unlikely they will ever 
be able to make space travel risk free. Nevertheless, perfection must continue to be the goal, 
for anything less is clearly unacceptable. 

When the Columbia Accident Investigation Board (CAIB) issued its final report in August 
2003, it included several recommendations that ultimately were not met. The CAIB 
understood this possibility, but it is the job of any accident board to identify all of the 
deficiencies it uncovers during its deliberations. The CAIB went further than most accident 
boards since it was dealing with a very complex and publicly-visible program. As the accident 
board wrote in its final report, “It is our view that complex systems almost always fail in 
complex ways, and we believe it would be wrong to reduce the complexities and weaknesses 
associated with these systems to some simple explanation.” 

Then-Administrator Sean O’Keefe embraced the CAIB recommendations and directed the 
Agency to implement all of them. This was undoubtedly the correct motivation at the time; 
the Space Shuttle was expected to remain in service for another 20 years or more. However, 
circumstances change. For the American space program, a major shift occurred on January 
14, 2004, when President George W. Bush announced the Vision for Space Exploration that 
will send astronauts back to the moon, and eventually to Mars. As part of this Vision, the 
President ordered that the Space Shuttle be retired no later than 2010, only 5 years after the 
return-to-flight of Discovery. 

This shift in National Policy had a major effect on the effort to return the Space Shuttle fleet 
to flight. NASA determined that there was no longer sufficient time, nor would it be prudent, 
to implement several of the CAIB recommendations; others must be reconsidered from a 
budgetary and schedule perspective given the limited number of missions remaining to be 
flown before the Space Shuttle is retired. 

The Return to Flight Task Group was not chartered to pass judgment on the CAIB report, but 
rather to assess the Agency’s implementation of the 15 recommendations the accident board 
indicated should be completed prior to returning to the Space Shuttle to flight. It was 
completely within the purview of NASA to determine if the recommendations were still valid 
given the new circumstances surrounding the future of the program. In several instances, 
NASA decided that it was not feasible to implement the CAIB recommendations in their 
entirety. The Task Group understands, and in some instances concurs, with the reasoning 
behind these decisions, but must still determine the Agency’s compliance with the 
recommendations as written and without reference to recent changes in the National Policy 
for space exploration. 
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Over the course of its 25-year history, the Space Shuttle Program has averaged just over four 
flights per year, a rate that has never allowed the system to fully mature as its designers 
originally intended. Nevertheless, the Space Shuttle has transported more people, from more 
countries, into space than all other launch vehicles combined. However, as the CAIB report 
correctly pointed out, the Space Shuttle is not now, has never been, nor will ever be, an 
“operational” vehicle. Instead, it is a developmental vehicle performing a dangerous mission 
in a known high-risk environment. Measured against similar systems, it has excelled at its 
task, but it can, and should have, done better. 

The Task Group - like the CAIB before it - does not believe that the Space Shuttle is an 
inherently unsafe vehicle. On the contrary, the Task Group believes it is a remarkable 
technological achievement that has served the Nation well for over 20 years. NASA and the 
aerospace industry have learned a great deal in those years, and the next vehicle will, 
hopefully, be safer and more reliable than the Space Shuttle. Nevertheless, constant vigilance 
will always be required to ensure NASA does not become complacent about the dangers of 
space flight. But we would be deceiving ourselves, and the American public, if we proclaimed 
that space travel will ever be “safe.” As the CAIB observed, “Building rockets is hard.” 
Building rockets for human travel is even harder. 

The United States has committed to human spaceflight, and in doing so, has also committed to 
accepting the risks associated with that endeavor, with the belief that our knowledge, skill, 
and perseverance will allow us to succeed. This will never be a safe, easy, or routine 
undertaking. The Administration, Congress, and the American public must be made aware of 
the dangers inherent in the technology and environments of space exploration. They must be 
assured that NASA and its contractors have done, and will continue to do, everything within 
their power to minimize the risks involved in this great undertaking. But they must also 
realize that it is likely that another accident will happen in the future; if not with Space 
Shuttle, then with whatever vehicle replaces it. 

The Space Shuttle Program must strive to identify and understand every potential risk - 
technical and programmatic - to the vehicle and crew. It must eliminate risk wherever 
possible, take steps to mitigate those risks that it can not eliminate, and carefully monitor 
those risks that it cannot control. The program must ensure that it is its own harshest critic 
since the vehicle and its environments are so complex that nobody will ever understand them 
better than the program itself. To accomplish this, NASA leadership must provide proactive 
oversight to ensure that the Space Shuttle Program does not overlook risks by being “too close 
to the problem.” In turn, the program must be completely honest with itself, NASA 
leadership, Congress and the American public, never minimizing the risks inherent in space 
flight, never making it appear to be easier than it is, and never forgetting that the price of 
failure is too high. Nothing less will honor the legacy of the 14 astronauts who perished in 
Challenger and Columbia. 


The orange glow of 
the setting sun 
paints a silhouette of 
Discovery (on the 
right) as it rolls out to 
Launch Complex 
39B at the Kennedy 
Space Center in 
preparation for the 
first mission after the 
loss of Columbia. 
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2 RELATIONSHIPS AMONG THE RECOMMENDATIONS 

A large majority of the CAIB return to flight recommendations rely on the results of other 
recommendations and should be placed in context to properly evaluate and appreciate the 
volume of work accomplished by NASA over the last two years. In many instances, the Task 
Group could not easily assess one recommendation without considering others. With few 
exceptions (R4.2-5; KSC Foreign Object Debris, and R4.2-3, Two Person Closeout 
Inspections), all of the technical and operational recommendations were closely linked via 
their relationship to the overall risk acceptance rationale used by NASA. In addition, the 
Agency’s response to the management recommendations influenced how the other 
recommendations were ultimately implemented. 

There was initial consideration within the Task Group of combining the assessments of 
several recommendations in this report, but ultimately it was believed that each assessment 
should stand alone - to the extent possible - to make it easier for the reader to locate the 
particular recommendation. However, it was also felt that it was necessary to explain the 
relationships among the recommendations. 

A similar quandary apparently confronted NASA. An early attempt within the NASA Safety 
and Mission Assurance community to integrate the intent of the recommendations into a 
whole came in the form of the Thermal Protection System Risk Reduction Framework, 
presented below. Using this framework, a larger picture emerges of the NASA 
implementation of the CAIB retum-to-flight recommendations. 

2.1 Thermal Protection System Risk Reduction Framework 

The most important technical issue to be resolved before returning to flight was preventing 
ascent debris from causing critical damage to the Orbiter Thermal Protection System. The 
Space Shuttle Program Safety and Mission Assurance Manager described a proposed 
framework for thermal protection system risk reduction to the RTF TG at the April 2004 
plenary. This framework, starting with primary hazard control, further delineated appropriate 
warning devices and special procedures to mitigate the risk of the primary hazard control not 
being completely satisfied, and directly encompassed several of the CAIB retum-to-flight 
recommendations. The Task Group found this useful for putting various recommendations in 
context with one another. 

The primary hazard control, or the first step in the roadmap, was to “Eliminate Critical 
Debris.” This was a combination of subparts: understand and improve the current ability of 
the Orbiter to withstand debris impacts (R3.3-2), ensure that the reinforced carbon-carbon 
panels currently in use were not already damaged (R3.3-1), and attempt to eliminate ascent 
debris (especially from the External Tank, R3.2-1, and SRB bolt catchers, R4.2-1). 

Warning devices encompassed the second and third steps in the roadmap. The second step, 
“Impact Detection During Ascent,” covered ground-based imagery (R3.4-1), high-resolution 
imagery of the ET (R3.4-2), observation cameras mounted on the ET and SRBs (a component 
of R3.4-3), data from National assets (R6.3-2), and data from the wing leading edge impact 
detection system (a component of the inspection portion of R6.4-1). Step III, “On-Orbit 
Debris Impact/Damage Detection,” dealt with the Orbiter Boom Sensor System (OBSS) and 
R-Bar Pitch Maneuver imagery taken from the International Space Station that are part of the 
inspection portion of R6.4-1 and which provide the high-resolution capability to meet R3.4-3. 

An implicit step in this roadmap was the integration of data from the warning devices into an 
assessment of any damage sustained by the Orbiter Thermal Protection System during the 
mission. The combination of that data with the knowledge of the capability of the Orbiter to 
enter with damage (the second part of R3.3-2) and closeout photography depicting the last 
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known state of the Orbiter (R10.3-1), results in a determination of whether repair (the other 
part of R6.4-1) needs to be initiated. Additionally, test and analysis provide the rationale to 
continue with entry or invoke the safe haven offered by Contingency Shuttle Crew Support 
(CSCS - SSP-3). The integration of this data has been the primary focus of the Task Group’s 
Integrated Vehicle Assessment Sub-Panel (IVASP) and is further addressed in Section 2.2. At 
the Task Group’s urging, MMT simulations (R6.3-1) and component simulations (R3.3-2 and 
R6.4-1) exercised the resulting process. However, the Task Group cautions that limitations in 
these inspection capabilities may still allow damage to go undetected. 
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The last two steps, which hopefully will never need to be exercised during a mission, are 
called “Special Procedures.” Step IV, “On-Orbit TPS Repair (Tile and RCC),” is addressed in 
the repair portion of R6.4-1. The final step of the roadmap, “Safe Haven and Crew Rescue,” is 
the focus of the “raising the bar” action for CSCS (SSP-3) that the Space Shuttle Program 
assigned to itself, and is not a direct response to a CAIB recommendation. 

On the management side, expanding the role of the Space Shuttle Integration Office to 
address the entire Space Shuttle system (R7.5-3) enabled the new Systems Engineering and 
Integration Office (SEIO) to lead the effort to understand the effects of debris, to assess the 
remaining risk due to critical debris, and to integrate the in-flight TPS assessment activities. 
Many of the efforts in the paragraphs above entail development activities, and therefore carry 
the possibility that some requirements may not be met and waivers will need to be processed. 
Restoring specific engineering technical authority, independent of programmatic decision¬ 
making (R7.5-1) and increasing the authority, independence, and capability of the Safety and 
Mission Assurance (SMA) organizations (R7.5-2) provide independent voices in the waiver 
and resulting risk acceptance deliberations that the CAIB felt were missing at the time of the 
Columbia accident (R9.1-1). 

Clearly, the more thoroughly critical debris can be eliminated (via a combination of reducing 
debris from the tank and increasing the ability of the Orbiter to withstand impacts), the less 
important the repair capability (with its attendant prerequisite ability to detect damage which 
needs to be repaired) or the rescue capability becomes. The more confidence in the detection 
and repair capabilities there is, the less the need for a crew safe haven and rescue function 
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exists. The crew rescue capability is only a last resort (no matter the confidence one has in it) 
because in this case, the crew is saved; however, the damaged Orbiter is not salvaged. In 
addition, invoking CSCS would have significant impacts on the ISS, including the possible 
need to evacuate the station. 

All of the steps in the roadmap have remaining uncertainties associated with them (see the 
column on the right of the diagram). There still exists a possibility that the Orbiter could 
sustain critical damage to the TPS. Limited actions were taken to harden the Orbiter, and there 
is a potential that debris from the External Tank could again critically damage an Orbiter 
during ascent. If such damage occurs, there is some risk that it could go undetected, not be 
repairable, or that a rescue mission could not be launched in time. Probabilistic analysis was 
used to quantify the residual risk of critical damage to the Orbiter Thermal Protection System 
from debris and is discussed in Section 3.3 as part of R3.3-2. Other risks are captured in the 
Integrated Hazard Reports. 

NASA acknowledges that the elimination of all critical debris is not attainable; therefore the 
Agency has analyzed and formally accepted the remaining risk as a condition for the return to 
flight. 

2.1.1 Summary 

Many within the RTF TG were encouraged with this proposed “top-down” approach for 
hazard reduction. Similarly, it would have been beneficial if NASA had performed a top- 
down requirements flow-down that recognized the relationship between seemingly 
disconnected system elements with cross-cutting functional connectivity. Some members of 
the Task Group expressed an interest in seeing this implementation technique applied to all 
items in the NASA Implementation Plan , but no evidence of this approach was found by the 
Task Group. The failure to accomplish these tasks may ultimately result in unintended 
consequences from a lack of integration between elements. 

The basic outline of the roadmap presented at the April 2004 plenary was eventually 
incorporated into a Headquarters document, The Integrated Risk Acceptance Approach For 
Return To Flight , intended to define the overall rationale for STS-114. The Task Group notes, 
however, this document has not been formalized - it has no author, no document number, no 
approval page, apparently no configuration management - and does not directly correlate to 
any program requirements. Nevertheless, progress has been made in incorporating risk 
reduction as part of various program, element, and project activities. 

2.2 Integrated Vehicle Assessment 

The RTF TG established the Integrated Vehicle Assessment Sub-Panel (IVASP) to combine 
insights from the Operations, Technical, and Management Panels in order to assess NASA’s 
ability to perform an integrated external damage assessment of the Orbiter based on a variety 
of data sources in direct support of real-time decision-making for Space Shuttle operations. 

2.2.1 The NASA Response 

As part of their return to flight effort, NASA developed a Orbiter Thermal Protection System 
readiness determination concept. This is documented in NSTS 60540, STS-114 Operations 
Integration Plan for Thermal Protection System Assessment , baselined April 12, 2005. This 
document states its intended purpose as, “This Operations Integration Plan (OIP) is the 
agreement on the responsibilities and tasks which directly relate to the integration activities 
associated with the successful system engineering, integration, and verification of the Space 
Shuttle return to flight activities associated with the assessment of the TPS. These operations 
are intended to provide the processes for transforming the data from the TPS assessment 
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systems into information that can be used by Mission Management to make a timely TPS 
entry readiness, repair, or safe haven determination. This document constitutes an agreement 
on the part of participating organizations concerning products and tasks described.” 

The OIP is the response to Program Requirements Control Board (PRCB) Directive S064005, 
Action 14-1, to develop an integrated operations concept for ascent film and video, Orbiter 
umbilical well cameras, Orbiter Boom Sensor System inspection, wing leading-edge 
instrumentation, and external resources. The document also includes the plan for integration 
of pad walk down debris reports, ascent radar, Solid Rocket Booster recovery reports, 
International Space Station photography during the R-bar Pitch Maneuver, and debris 
transport analysis. In addition, the OIP includes an Annex, Orbiter Damage Assessment 
Process, that documents the damage assessment process, and the decision timeline required to 
support a safe entry assessment. The document focuses specifically on a description of the 
operations, the work and analysis to be performed, process dependencies, process flows, 
process responsibilities, and the verification requirements from an integrated perspective. 


NASA timeline to 
collect, process and 
assess ascent and 
on-orbit data to 
determine the state 
of the Orbiter 
Thermal Protection 
System during a 
mission. 
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The OIP was developed based on the assets baselined for STS-114 with a daylight launch 
constraint; however, many of the processes outlined in this document are generic in nature 
and could apply to any Space Shuttle mission. Nevertheless, due to the evolutionary nature of 
the specific complement of assets, it was necessary to address the specific STS-114 
configuration for the baseline release of the OIP. It is currently NASA’s intent to update the 
document for future missions as the asset configurations and timelines required to support 
decision-making change, as well as to capture changes to the process deemed necessary to 
better support decision-making. 

2.2.2 RTF TG Assessment 

The Task Group commends the OIP and Damage Assessment Annex developers. Beginning 
from scratch, they have evolved a process that holds the promise of integrating a variety of 
new and disparate types of data into information that can support complex decision-making 
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during flight. To do this, the developers had to work across NASA boundaries to identify the 
best organization to be responsible for each data source. They had to secure commitments 
from these organizations to produce data analysis reports on a specified timeline and to share 
those reports through the OIP. They have also identified and established new positions of 
authority required to set priorities on data collection and analysis to meet emerging real-time 
needs. They have conducted an aggressive training plan to exercise each component of the 
assessment process as well as the MMT use of the information. Finally, they fully 
documented the process so that it can be evolved as data sources change, studied by new 
participants in the process, and evaluated by outside observers. 

The Task Group recognizes that the OIP and Damage Assessment Annex will continue to 
mature through STS-114 and, hopefully, beyond. NASA needs an ability to manage risk 
during flight, and these two documents represent a significant step in that direction. The 
CAIB recommendations identified specific data necessary to better understand the risk to the 
Orbiter of a debris impact. The Operations Integration Plan was developed to integrate the 
data from the new data sources developed for retum-to flight and the Damage Assessment 
Annex was developed to clearly define how those data would be interpreted. We see the 
Space Shuttle Program’s experience in these development initiatives as having potential that 
goes beyond the specific Thermal Protection System assessment sources developed for STS- 
114. It represents an approach that pulls information from across NASA boundaries into a 
consolidated, integrated “whole.” There will likely be other anomalous situations during flight 
where such an approach could help the decision-makers assess and manage risk. 

2.2.3 RTF TG Observations 

During its assessment of the OIP, the Task Group had several observations. 

2.2.3.1 OIP/Damage Assessment Annex Development and Documentation 

NASA should continue to support and resource the OIP and Damage Assessment Annex 
processes. Furthermore, their accomplishments should serve as a model for tackling other 
integration challenges that NASA faces. 

The Space Shuttle Program published several draft versions of the STS-114 Operations 
Integration Plan, culminating in the baseline version on April 12, 2005. Beginning in 
December 2004, NASA conducted a series of component simulations (sims), designed to test 
specific pieces of the OIP, and mini-integration simulations, designed to test parts of the 
process that involve integration. As elements of the OIP matured, they were incorporated into 
MMT simulations. These led to MMT sim #12, conducted in March 2005 that specifically 
included a number of Orbiter Thermal Protection System incidents requiring assessment. The 
Space Shuttle Program conducted a component sim the week prior to this MMT and used the 
outputs of the component sim as inputs to the full-scale MMT sim. 

The Space Shuttle Program also released a revised version of the Orbiter Damage Assessment 
Process Annex on March 1, in time to support MMT sim #12. The IVASP reviewed the first 
version of this Annex in December 2004. The current revision is more mature and includes a 
detailed description of the processes the program will use to take the data collected and 
integrated through the OIP and use it to actually assess the status of the Thermal Protection 
System. The Annex further includes frameworks for risk-versus-risk assessments for both tile 
and RCC damage and repair activities. This Annex should continue to be exercised in the 
component and mini-integration sims scheduled before flight. The Space Shuttle Program 
should update both the OIP and Annex before flight to incorporate the lessons they have 
learned from their work through the sims, as well as incorporate final decisions for STS-114 
resulting from the Debris DVR, the Program DCR, the FRR, and model validation. 
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2.23.2 Structured Assessment during Flight 

During flight, the information and understanding gained from the STS-114 experience will be 
invaluable for future mission data integration. The Operations Integration Plan and Damage 
Assessment Process Annex developers should put in place a structured process to capture 
records of the data collected and the processes used to integrate and assess it during flight. 
The results of a review of this information coupled with the experiences of the participants 
should form the basis for the post-STS-114 OIP/Annex revisions. 

2.2.33 Critical Dama^e/Debris Size Definition 

The Space Shuttle Program must continue to mature its critical damage and critical debris 
assessments and incorporate the results into the OIP and Annex. The results of these 
assessments determine the operation and processing of some of the key sensors, such as those 
on OBSS. This could change the timelines the OIP has developed to ensure the data will be 
available to support the damage assessment process and associated key decisions. 

2.23.4 Camera Requirements Analysis 

During MMT sim #12, the participants debated the significance of the loss of a suite of 
ground cameras. Some participants felt that the camera’s “Criticality 3” status made clear that 
they were not a constraint to flight, while others felt that the loss would preclude collection of 
important mission-essential information. Before the launch of STS-114, the Task Group 
believes that the relative importance of each camera (as well as all STS-114 inspection and 
imagery capabilities) should be pre-determined, to the extent possible, so that there is a 
clearer basis for these decisions. The Task Group is not recommending that the criticality of 
these cameras be changed. Rather we believe that, with all the cameras and sensors now 
available to NASA, the implications of the loss of a particular sensor need to be clear as the 
trade-offs are debated. This is even more of a factor for STS-114 since one of its explicit 
objectives is to document the debris environment actually experienced. 

Because many of the cameras are redundant and because data are available at different times, 
this determination requires analysis. We believe the OIP developers have the expertise to do 
this work and the OIP is the best place to document the results. The Task Group recognizes 
that, for some views, there are so many cameras that it would be extremely time-consuming to 
detail all the permutations. While we still believe the full analysis should be done and 
documented eventually, it would be prudent for the OIP developers to focus on those views 
where there is little or no redundancy so that the implications of the loss of one or more of 
those systems are clear in time for the launch of STS-114. 

Additionally, resources must be made available to sustain the enhanced imagery capability 
that feeds the inspection and damage assessment for the remainder of the Space Shuttle 
Program. There are inherent risks in space flight and the ability to observe and analyze the 
state of the vehicle to a high degree of confidence will always be required. It is imperative 
that NASA accept the responsibility to protect this capability, to use it for all missions, and 
continue to evaluate methods to improve it within limits for the duration of the Space Shuttle 
Program and for future programs. 

2.2.4 Summary 

The OIP and its Damage Assessment Annex represent a significant step toward developing a 
process to integrate and assess a variety of important information from disparate sources. The 
Task Group commends NASA for its progress in this area and recommends that this work 
continue after STS-114. The Task Group further suggests that the development of the OIP and 
its Annex could serve as a model for other cross-NASA integration projects. 
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3 ASSESSMENT OF THE CAIB RECOMMENDATIONS 

What follows is a section for each of the 15 Columbia Accident Investigation Board (CAIB) 
return-to-flight recommendations and the “raising-the-bar” SSP-3 action; the three Chapter 7 
recommendations (R7.5-1, R7.5-2, and R7.5-3) that are subordinate to R9.1-1 are covered in 
Section 3.14. In each case the section repeats the original recommendation word-for-word, 
gives the RTF TG interpretation of the recommendation, provides a brief background (often 
taken directly from the CAIB report), details the NASA implementation, and concludes with 
the Task Group’s final assessment of the progress NASA made toward implementing the 
recommendation. 

The section entitled “NASA Implementation” contains descriptions taken from the 
appropriate version of the NASA Implementation Plan for Space Shuttle Return to Flight and 
Beyond , based on the date for the individual assessment was deliberated. (The RTF TG 
generally called this document the NASA Implementation Plan for brevity.) Additional 
information from the closure packages submitted by NASA, requests for information, and 
fact-finding activities are also included as necessary to ensure an adequate description. In 
general, the description presented in this section is a snapshot of the progress made when the 
Task Group concluded its assessment; in many cases, things changed between then and the 
release of this report. It is not the intent of the Task Group to “put words in NASA’s mouth” 
and in case of disagreement between this document and any official NASA publication, the 
NASA document shall prevail. 

The following table summarizes the Task Group’s assessment of the CAIB return-to-flight 
recommendations. 


1 





3.1 


3.2-1 

External Tank Debris Shedding 

June 27, 2005 

Not Met 

3.2 


3.3-1 

Reinforced Carbon-Carbon 
Non-Destructive Inspection 

February 17, 2005 

Met 

3.3 

3.3-2 

Orbiter Hardening 

June 27, 2005 

Not Met 

3.4 

3.4-1 

Ground-Based Imagery 

June 8, 2005 

Met 

3.5 

3.4-2 

High-Resolution Images of 

External Tank 

December 16, 2004 

Met 

3.6 

3.4-3 

High-Resolution Images of Orbiter 

June 8, 2005 

Met 

3.7 

4.2-1 

Solid Rocket Booster Bolt Catcher 

December 16, 2004 

Met 

3.8 

4.2-3 

Two-Person Closeout Inspections 

December 16, 2004 

Met 

3.9 

4.2-5 

Kennedy Space Center 

Foreign Object Debris Definition 

December 16, 2004 

Met 

3.10 

6.2-1 

Consistency with Resources 

June 8, 2005 

Met 

3.11 

6.3-1 

Mission Management Team 
Improvements 

June 8, 2005 

Met 

3.12 

6.3-2 

National Imagery and Mapping 
Agency Memorandum of 

Agreement 

December 16, 2004 

Met 

3.13 

6.4-1 

Thermal Protection System 
Inspection and Repair 

June 27, 2005 

Not Met 

3.14 

9.1-1 

Detailed Plan for 

Organizational Change 

June 8, 2005 

Met 

3.15 

10.3-1 

Digitize Closeout Photos 

December 16, 2004 

Met 

3.16 

SSP-3 

Contingency Shuttle Crew Support 

June 8, 2005 

n/a 
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Discovery, atop a 
Mobile Launch 
Platform (MLP), 
crawls toward 
Launch Complex 
39B on April 6, 2005. 
The MLP is moved 
by the Crawler- 
Transporter 
underneath. The 
crawler stands 20 
feet high, 131 feet 
long and 114 feet 
wide and moves on 
eight tracks, each 
containing 57 cleats 
weighing one ton 
each. The crawler 
moves at a 
maximum speed of 
approximately 0.8 
mile per hour while 
carrying the 
3 million pound 
Space Shuttle stack. 
Note the “We’re 
Behind You, 
Discovery” banner 
on the MLP. 
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3.1 CAIB Recommendation 3.2-1 - 
External Tank Debris Shedding 

Initiate an aggressive program to eliminate all External Tank Thermal Protection System 
debris-shedding at the source with particular emphasis on the region where the bipod struts 
attach to the External Tank. 

3.1.1 RTF TG Interpretation 

Eliminate all sources of critical debris in locations where liberated debris might impact the 
Orbiter, eliminate the bipod strut foam entirely if possible, and determine the foam void size 
that produces debris of an acceptable size based on the transport and energy analyses. 

3.1.2 Background 

The Columbia accident clearly demonstrated that the Orbiter Thermal Protection System, 
including the reinforced carbon-carbon (RCC) panels and acreage tiles, was vulnerable to 
impact damage from the existing debris environment. As a result, the Columbia Accident 
Investigation Board (CAIB) issued recommendations to eliminate debris (R3.2-1), determine 
the structural integrity of the RCC (R3.3-1), harden the Orbiter (R3.3-2) against impacts, and 
to develop on-orbit repair capabilities (R6.4-1). 

The External Tank (ET) is the largest element of the Space Shuttle system. Because it is the 
common element to which the Solid Rocket Boosters and the Orbiter are connected, the ET 
serves as the main structural component during stacking, launch, and ascent. Lockheed Martin 
builds the tank at the Michoud Assembly Facility, Louisiana, under contract to the NASA 
Marshall Space Flight Center. 

The External Tank is 153.8 feet long, 27.6 feet in diameter, and comprises three major 
sections: the forward (upper) liquid oxygen tank, the aft (lower) liquid hydrogen tank, and the 
intertank area between them. The ET holds 143,351 gallons of liquid oxygen at minus 297 
degrees Fahrenheit and 385,265 gallons of liquid hydrogen at minus 423 degrees Fahrenheit. 




ET-120, the External 
Tank originally 
scheduled for use on 
STS-114, arrives at 
the Kennedy Space 
Center. Various 
anomalies with this 
tank forced the 
program to switch to 
ET-121, the tank 
originally scheduled 
for STS-121. 
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Several different types of foam insulating material are applied to the ET. The acreage foam 
that covers the majority of the ET prevents the formation of ice as moist ambient air comes in 
contact with the aluminum skin of the ET when it is filled with cryogenic propellants. Other 
types of foam and lightweight ablator materials are designed to protect the External Tank 
from aerodynamic heating as the vehicle accelerates during ascent. The ET was designed to 
be economical to produce since it is the only “throw away” portion of the otherwise reusable 
Space Shuttle. The construction techniques chosen - both for economy and to minimize 
weight - made it infeasible to use an internal insulation instead of the acreage foam. 

NASA maintains that foam remains the only viable technical solution for providing a 
lightweight, efficient, external thermal protection system. However, foam poses a variety of 
manufacturing challenges. For example, it is subject to small voids during application, 
especially around complex geometries such as joints or protrusions. This problem is 
exacerbated by the fact that foam for complicated areas must be manually applied, instead of 
the more consistent automated process that is used for the smooth areas. Using non¬ 
destructive inspection to find inconsistencies or defects in the foam is an engineering 
challenge that has eluded a reliable technical solution. NASA has conducted several searches 
for non-destructive inspection techniques in industry and research institutions and has made 
repeated attempts to develop a method of inspecting the foam for correct application; to date 
these have only been partially successful. As an alternative to inspection, NASA has 
incorporated strict process controls for both automated and manual foam applications. 

The accident board found that foam loss had occurred on more than 80 percent of the 79 
missions for which imagery was available, and foam was lost from the left bipod ramp on 
nearly 10 percent of the 72 missions where the left bipod ramp was visible following ET 
separation. It was foam debris from the left bipod ramp that caused the Columbia accident. 
For about 30 percent of all missions, there was no way to determine if foam was lost; these 
were either night launches, or the External Tank bipod ramp areas were not in view when the 
images were taken. The ET was not designed to be recovered after separation, depriving 
NASA of physical evidence that could help pinpoint why foam separates from it. Photography 
of the ET after separation - although routinely accomplished - was not a priority for the 
Space Shuttle Program prior to the Columbia accident. 

A complete description of the External Tank and this problem, as explained by the accident 
board, may be found in the CAIB final report, Volume I, Section 3.2. 

3.1.2.1 ET Debris Sources 

During the early 1990s, NASA attributed several instances of foam loss to de-bonds or voids 
in the “two-tone foam” bond layer on the intertank area forward of the bipod ramp. It was 
thought that when the intertank foam was liberated, it peeled portions of the bipod ramp off 
with it. Corrective action taken after STS-50 in June 1992 included the implementation of a 
two-gun spray technique in the ET bipod ramp area to eliminate the two-tone foam 
configuration. This appeared to have solved the problem until the sixth bipod ramp event oc¬ 
curred during STS-112 on October 7, 2002, two flights prior to STS-107. 


A bipod ramp like the 
one shown here was 
the debris that 
doomed Columbia 
on her last flight. 
These ramps have 
been completely 
eliminated from 
the modified 
External Tanks. 



After the STS-112 bipod ramp foam loss event, 
the ET Project began developing concepts to 
redesign the bipod ramp; this activity was still 
under way at the time of the STS-107 accident. 
The dissection of bipod ramps conducted for the 
Columbia accident investigation indicated that 
defects resulting from a manual foam spray 
operation over an extremely complex geometry 
could produce foam loss. 
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NASA evaluated 16 
areas of the ET 
thermal protection 
system for debris 
shedding. Eventually 
five areas of foam 
(numbers 5, 6, 8, 10, 
13) plus a source of 
ice debris at the L02 
feedline bellows (not 
shown) were 
selected for 
improvement or 
redesign based on 
their likelihood to 
liberate critical 
debris. 


The L02 and LH2 PAL (protuberance air load) ramps are designed to reduce adverse 
aerodynamic loading on the ET cable trays and pressurization lines. PAL ramp foam loss was 
observed on two flights, STS-4 and STS-7. The most likely cause of these losses were earlier 
repairs and cryo-pumping (air ingestion) into the super-lightweight ablator (SLA) panels 
under and adjacent to the PAL ramps. Configuration changes and repair criteria were revised 
early in the program, to mitigate recurrence of these failures. The PAL ramps are large, thick, 
manually sprayed foam areas that use a less complex spray process than that used on the 
bipod; however, if liberated the ramps could become large debris. 

Another area of special interest was the intertank that separates the L02 tank from the LH2 
tank. The area where the intertank connects to the pressurized hydrogen tank is called the 
LH2/intertank flange. Imagery taken after ET separation showed repeated loss of foam from 
this flange area prior to STS-107. 


Further investigation showed that another potential source of debris was the L02 feedline, a 
large external pipe that runs the length of the External Tank. Bellows are located at three 
joints along the feedline to accommodate thermal expansion and contraction. The bellows 
shields are covered with foam, but the ends are exposed. Because of the cryogenic fluids in 
the pipe, ice and frost form when moisture in the air contacts the cold surface of the exposed 
bellows as well as on five brackets that hold the feedline to the ET. 

Space Shuttle Program requirements included provisions for ice on the feedline bellows, 
brackets, and adjacent lines. However, ice in these areas is a potential source of debris in the 
critical debris zone - the area from which liberated debris could impact the Orbiter. Ice has 
been seen on all missions, and after a review of flight history, NASA believes a portion of the 
historical debris damage was the result of ice impacts. 


It should be noted that, despite extensive analysis and tests, to date, neither the CAIB nor 
NASA have been able to absolutely determine the root cause for the loss of the bipod ramp 
foam during the last flight of Columbia. Additionally, the accident board also was not able to 
determine that the SRB bolt catchers, while an unlikely cause, could be definitively excluded 
as a potential cause of the left wing damage on Columbia. 

3.1.3 NASA Implementation 

After the Columbia accident, NASA initiated a three-phase approach to eliminate the potential 
for debris shedding - such as ice and foam - from the External Tank. Phase 1 included those 
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activities completed prior to the retum-to-flight that would control critical debris on tanks 
already constructed. NASA determined that the Phase 2 activities were not required for return 
to flight, but rather focused on continuous improvement including debris elimination 
enhancements that could be incorporated into the ET production line for new tanks. Phase 3 
would have examined additional means of further reducing ET debris potential; however, 
NASA does not plan to implement Phase 3 since the Space Shuttle is scheduled to be retired 
at the end of the decade. 


NASA made several 
modifications to the 
External Tank to 
reduce foam and ice 
debris during ascent. 
Although all are 
considered 
successful, testing 
and analysis show 
that the ET can still 
shed critical debris. 



Remmr /Replace 
Longcr&n CttiseotitS 



Inlcrfattk / LHI Tank Fifing? 
flnsraui k'nhanrrmFnt 




Ice Mfrigfithw - LQ2 FeertHnr 
Be flaws TPS Drip Lip 
{3 Inratronx} find Heater 
tfysrfffi location) 


Redesigned 
11 ip a d I itling 



Partial LH2 PAl. Ramp ReplacrmrnI 
(required to arc ?,is underlying flange) 


Increase Area of denied 
Intertank TPS 


As part of the Phase 1 effort for return to flight, NASA modified the areas of known critical 
debris sources, although NASA has never determined the root cause for all instances of foam 
shedding. This included redesigning the forward bipod fitting and associated thermal 
protection system closeout, redesigning the LH2/intertank flange thermal protection system 
closeout, and reducing ice formation on the L02 feedline bellows. ET intertank venting was 
increased to reduce popcoming masses in the ET foam. 

In addition to addressing these known areas of debris, NASA has reassessed all areas of the 
ET to verify the robustness of the thermal protection system configuration, including both 
automated and manual spray applications. Special consideration was given to the L02 and 
LH2 PAL ramps due to size and location. Although there is no significant history of foam 
liberation from the longeron area, the ET Project took the conservative path of removing and 
reapplying part of this area with an improved foam application process. 


NASA also pursued a testing program to understand the root causes of foam shedding from 
various areas (with varying degrees of success) and developed alternative design solutions to 
reduce the debris loss potential. Additionally, NASA is continuing the development of two 
non-destmetive inspection techniques - tetrahertz imaging and backscatter radiography - to 
conduct ET thermal protection system inspection without damaging the fragile insulating 
foam. During Phase 1, non-destmetive inspection was used on the L02 and LH2 PAL ramps 
as engineering information only; certification of the foam was achieved primarily through 
verifying the application and design. 

The bipod fitting design, fitting closeout, and heater system were reviewed during the ET 
Design Certification Review. The verification included thermal tests to determine the 
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capability of the design to preclude prelaunch ice, with an automated heater control baselined 
and validated based on bipod web temperature measurements. Structural verification tests 
have confirmed the performance of the modified fitting in simulated flight environments. 
Wind tunnel testing has verified the thermal protection system closeout performance when 
exposed to the expected ascent aerodynamic and thermal environments. 



The most visible 
change to the 
External Tank was 
the elimination of the 
bipod ramps on the 
forward ET attach 
point and the 
installation of 
heaters in the same 
area. The loss of one 
of these foam ramps 
was responsible for 
the loss of Columbia. 


Initially, NASA selected a “drip lip” to reduce ice formation on the three L02 feedline 
bellows. The drip lip diverts condensate from the bellows and significantly reduces ice 
formation. However, since the drip lip alone was not sufficient to completely eliminate the 
ice, NASA continued to pursue complementary solutions. By April 2005, analysis of the ice 
formation, estimates of the liberated ice, and transport analyses identified the residual ice at 
the forward L02 feedline bellows location as an unacceptable debris source; therefore, 
additional reduction of ice at the forward location was required before return to flight and 
resulted in moving the launch date from May 2005 to July 2005. 



Three photos 
showing ice 
accumulation on the 
forward L02 feedline 
bellows. The drip lip 
was initially chosen 
for return to flight, 
but ultimately the 
heater was installed 
to further mitigate the 
problem. 


During the delay, NASA installed a heater in the forward L02 bellows cavity to reduce ice 
formation to an acceptable level. Bonding of the heaters required removal and replacement of 
a 3-inch wide strip of foam along the existing drip lip and L02 feedline surface. The heater 
has been installed in the tanks that will be used for STS-114, STS-121, and all future flights. 
No modifications other than the drip lips have been implemented for the mid and aft bellows 
for STS-114; NASA continues to assess other ice mitigation techniques for these locations for 
future flights. 
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Details of the bellows 
heater installation. 
This heater was 
installed at the 
Michoud Assembly 
Facility on the third 
post-Columbia ET 
(ET-119), but was 
retrofitted at the 
Kennedy Space 
Center on the first 
two tanks (ET-120 
and 121). 



! 


wire routed under fvsm 
to L 02 feedline fairing 
penetration to Inlertank 



Nsaier Jnsta-ffetf 
in bellows cavil/ 


NASA determined the primary root cause of foam loss in the intertank/LH2 tank flange area 
was the gaseous nitrogen used as a safety purge in the intertank coming into contact with the 
extremely cold hydrogen tank dome and condensing into liquid. The liquid nitrogen migrated 
through intertank joints, fasteners, vent paths, and other penetrations into the foam and then 
filled voids in the foam caused by variability in the manual foam application. During ascent, 
the LN2 returned to a gaseous state, pressurizing the voids and causing the foam to detach. 
With this knowledge, NASA evaluated the LH2/intertank closeout design to minimize foam 
voids and nitrogen leakage from the intertank into the foam. 


The new three-step 
enhanced closeout 
process for the LH2 
intertank area. 



The solution ultimately chosen for this area was replacement of the existing intertank closeout 
with a three-step enhanced closeout process. NASA is relying on the enhanced process in the 
LH2 intertank area to reduce the presence of defects within the foam to reduce or eliminate 
void formations in the area of the flange joining the LH2 tank to the intertank. 


Because NASA believed the PAL ramps had a satisfactory flight history and there was no 
evidence of foam loss since the last configuration change after STS-7, the baseline approach 
for return to flight was to develop sufficient certification data to accept the minimal debris 
risk of the existing design. However, a portion of the LH2 PAL ramp spans the high-risk LH2 
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flange closeout. The forward 10 feet of the 38-foot-long LH2 PAL ramp was removed to 
access the underlying intertank/LH2 tank flange closeout and then replaced using an 
improved manual spray application process. 

Changes were also implemented on the intertank thrust panels to increase venting to reduce 
foam loss from “popcoming” and additional changes to the aft longeron were made to reduce 
likelihood of foam cracks and ice balls. 

The improved processes developed for the manual application of foam on the ET were used in 
limited areas of the External Tanks slated for STS-114 and STS-121 because those tanks had 
been completed prior to the Columbia accident. The use of these improved processes will be 
expanded on future tanks depending on how far through the manufacturing process those 
tanks had progressed prior to the introduction of the processes. 

Since the Phase 2 and Phase 3 efforts are not directly related to STS-114, they are not covered 
here. Details of these efforts may be found in the NASA Implementation Plan. 

Improved non-destmctive inspection capabilities will provide greater knowledge of the 
condition of the External Tank foam in critical areas and the integrity of the Orbiter RCC 
prior to launch. Although an improvement, these capabilities use the best available technology 
to provide a view of what is beneath the surface, but will not allow NASA to verify the 
precise condition of foam. NASA has elected to accept the risk associated with the limitations 
of the available non-destmctive inspection capabilities. 

NASA intended to use a “lead tank/trail tank” approach to support the return to flight 
activities, with the trail tank (ET-121, intended for STS-121) or a launch-on-need rescue 
mission) not shipping until after the final Design Certification Review (DCR). Because the 
final DCR was rescheduled after the required ship date for the trail ET, the Space Shuttle 
Program reassessed the risk of shipping the trail ET after the DCR versus the risk of shipping 
prior to DCR to protect the capability for a rescue mission (STS-300). Since the ET DCR Pre- 
Board on February 23-25, 2005 did not disclose any issues that would prevent shipping the 
trail tank, the program decided the approach with the least total risk was to ship the trail ET 
on March 5, prior to the first ET DCR Board on March 8, 2005. 

NASA acknowledges that the elimination of all critical debris is not attainable, and has 
analyzed and formally accepted the remaining risk as a condition for the retum-to-flight. 
Additional information on this risk analysis can be found in Section 3.3 (R3.3-2). 

3.1.4 RTF TG Assessment 

For two days beginning on September 30, 2003, several members attended a series of 
informal one-on-one meetings with members of the ET Project at the Michoud Assembly 
Facility. Numerous fact-finding activities were held at a variety of locations throughout 2004. 
Subsequently, the RTF TG attended the External Tank DCR Pre-Board on Febmary 24-25, 
2005 and the ET Program DCR on March 8-9, 2005. The Task Group also attended the 
second ET DCR on June 20, 2005 that addressed the addition of the feedline bellows heater. 

To their credit, the External Tank DCRs were accomplished in a traditional manner, including 
formal data packages, screening of discrepancies, pre-boards, and formal boards. The two 
most significant issues for the DCR Board in March 2005 were pertaining to the verification 
of “use as-is” foam insulation on ET-120 (for STS-114) and ET-121 (for STS-121), and the 
limited amount of data from formal certification testing. The approach taken for the use as-is 
foam was to “verify by similarity” using data from the dissection of ET-94 (the thermal 
protection system on ET-94 was carefully examined by removing parts of it during the 
accident investigation). The ET Project documented all exceptions to the verification process 
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in a new document, NSTS 60555, Verification Limitations for the External Tank Thermal 
Protection System, instead of processing individual waivers. 

As observed during the fact-finding, the ET Project conducted an extensive effort to 
understand the root causes of foam and ice debris generation, and this has resulted in new 
knowledge about foam and ice and what causes them to be shed from the tank during ascent. 
The ET Project determined that the most likely cause of debris generation was the 
“adhesive/cohesive” failure mode and used this as their basis of acceptance based on observed 
subsurface void size. Other failure modes, including “knit line failure” and “surface/kissing 
debonds” in acreage areas, were not addressed through design or process modifications. These 
additional failure modes offer a potential for the production of debris, although flight history 
has indicated that this debris production has not been previously observed. The processes for 
manual application of foam insulation have been changed to include greater process control 
and quality inspection. The Task Group notes that investigations into ice formation came very 
late during the retum-to-flight effort due to the amount of time spent evaluating foam. 

The ET Project implemented an aggressive program to eliminate critical foam and ice debris 
and met the initial debris-allowable requirements allocated to them by the Space Shuttle 
Program. Even so, the debris-allowable requirements provided to the ET Project did not 
match what was later determined to be the impact tolerance of the Orbiter. Thus, in spite of a 
great deal of excellent work on the part of the Agency and its contractors, the External Tank 
can still shed debris that could potentially result in critical damage to the Orbiter. It should be 
noted that the potential to liberate critical debris has been significantly reduced. 

In the final analysis, the Task Group believes that the ET Project worked diligently and 
successfully met the requirements they were provided; unfortunately, those requirements were 
later determined to be inadequate. Updated requirements have been delayed mainly because 
the development of debris models and transport analysis has been hampered by a lack of rigor 
in both development and testing. However, as discussed in Section 3.3 (R3.3-2), the Space 
Shuttle Program has developed an accepted-risk rationale for the return to flight which was 
approved by program and agency leadership. 

The RTF TG assessment of NASA’s actions was completed at the June 27, 2005 meeting. The 
intent of CAIB Recommendation 3.2-1 has not been met. 

3.1.5 RTF TG Observation 

Although the Space Shuttle Program has performed an extensive effort to reduce debris for 
return to flight, there still is the potential - although reduced - for foam and ice to cause 
critical damage to the Orbiter. 

The Task Group believes that the Space Shuttle Program should continue their program 
to eliminate critical debris by aggressively working off the limitations documented in 
NSTS 60555, Verification Limitations for the External Tank Thermal Protection System. 

The Task Group also notes that the processes for manual application of foam insulation on the 
ET have changed to include greater process control and quality inspection. These processes 
are costly, but the Task Group feels that these processes should be maintained over time. 

3.1.6 RTF TG Minority Opinion 

The ET Project and Space Shuttle Program have initiated an aggressive program to eliminate 
ET debris and, within the exceptions and limitations as documented in NSTS 60555, 
Verification Limitations for the External Tank Thermal Protection System , and the Technical 
Panel believes that NASA met the intent of CAIB recommendation 3.2-1. 
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3.2 CAIB Recommendation 3.3-1 - 

Reinforced Carbon-Carbon Non-Destructive Inspection 

Develop and implement a comprehensive inspection plan to determine the structural integrity 
of all Reinforced Carbon-Carbon system components. This inspection plan should take 
advantage of advanced non-destructive inspection technology. 

3.2.1 RTF TG Interpretation 

Rebaseline the reinforced carbon-carbon components by recycling through the original 
inspection process, and also using advanced technology as appropriate. 

3.2.2 Background 

The Columbia accident clearly demonstrated that the Orbiter Thermal Protection System, 
including the reinforced carbon-carbon (RCC) panels and acreage tiles, was vulnerable to 
impact damage from the existing debris environment. As a result, the Columbia Accident 
Investigation Board (CAIB) issued recommendations to eliminate debris (R3.2-1), determine 
the structural integrity of the RCC (R3.3-1), harden the Orbiter (R3.3-2) against impacts, and 
to develop on-orbit repair capabilities (R6.4-1) 


An advanced composite called reinforced carbon-carbon (RCC) is used on the Orbiter wing 
leading edge, nosecap, chin panel, and forward ET attach point. RCC is a graphite-impreg¬ 
nated rayon fabric laminate, further impregnated with phenolic resin and layered, one ply at a 
time, in a unique mold for each part, then cured, rough-trimmed, drilled, and inspected. The 
part is then packed in calcined coke and fired in a furnace to convert it to carbon and is made 
denser by three cycles of furfuryl alcohol vacuum impregnation and firing. 




Forward ET 
Attach Point 
Arrowhead 
RCC Plates 


WLE Attach 
Hardware 


There are four areas 
of each Orbiter 
protected by RCC - 
the nosecap, the 
wing leading edges, 
chin panel, and the 
forward ET attach 
point. Damage to 
one RCC panel on 
the wing leading 
edge led to the 
destruction of 
Columbia. 


To mitigate oxidation, the outer layers of the carbon substrate are converted into a 0.02-to- 
0.04-inch-thick layer of silicon carbide in a chamber filled with argon at temperatures up to 
3,000 degrees Fahrenheit. As the silicon carbide cools, “craze cracks” form because the 
thermal expansion rates of the silicon carbide and the carbon substrate differ. The part is then 
repeatedly vacuum-impregnated with tetraethyl orthosilicate to fill the pores in the substrate, 
and the craze cracks are filled with a sealant. 
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The development of RCC by Ling-Temco-Vought (now Lockheed Martin Missiles and Fire 
Control) was key to meeting the wing leading edge requirements for the Orbiter Thermal 
Protection System. Each wing leading edge consists of 22 RCC panels, numbered from 1 to 
22 moving outward on the wing (the nomenclature is “5-left” or “5-right” to differentiate, for 
example, the two number 5 panels). Because the shape of the wing changes from inboard to 
outboard, each panel is unique. 

The rate of oxidation is the most important variable in determining the mission life of RCC 
components. Oxidation of the carbon substrate results when oxygen penetrates the 
microscopic pores or fissures of the silicon carbide protective coating. The subsequent loss of 
mass due to oxidation reduces the load the structure can carry and is the basis for establishing 
a mission life limit. The oxidation rate is a function of temperature, pressure, time, and the 
type of heating. Repeated exposure to the Orbiter’s normal flight environment degrades the 
protective coating and accelerates the loss of mass. Currently, the mass loss of flown RCC 
components cannot be directly measured. Instead, mass loss is predicted analytically using a 
methodology based on rates experimentally derived from simulated entry environments. This 
approach then uses derived entry temperature-time profiles of various portions of RCC 
components to estimate the actual entry mass loss. 

The accident board determined that the on-vehicle inspection techniques in use at the time of 
the Columbia accident were inadequate to assess the structural integrity of the RCC 
components and attachment hardware. There were two aspects to the problem: (1) how NASA 
assessed the structural integrity of RCC components and attach hardware throughout their 
service life, and (2) how NASA verified that the flight-to-flight RCC mass loss caused by 
aging did not exceed established criteria. Structural integrity was thought to be ensured by 
wide design margins, and at the time, comprehensive non-destructive inspection was 
conducted only when the component was manufactured. Mass loss was monitored through a 
destructive test program that periodically sacrificed flown RCC panels to verify that the actual 
material properties of the panels were within the predictions of the mission life model. 

3.2.3 NASA Implementation 

After the Columbia accident, the Space Shuttle Program conducted an initial assessment of 
commercially-available equipment capable of verifying the structural integrity of RCC 
hardware while it is on the vehicle. A technical interchange meeting held in May 2003 
included experts from across the country. A variety of non-destructive inspection technologies 
with potential for near-term operational deployment were presented to the Program 
Requirements Control Board (PRCB) in January 2004: (1) flash thermography, (2) ultrasound 
(wet and dry), (3) advanced eddy current, (4) shearography, and (5) radiography. 

Thermography, contact ultrasonics, eddy current, and radiography were selected as the most 
promising techniques that could be developed in less than 12 months to be used for on-vehicle 
inspection. The PRCB approved the budget for the development of these techniques. 
Ultimately, contact ultrasonics was deemed less promising than the other techniques and its 
development was discontinued. The remaining techniques will continue to be developed and 
fielded at the Kennedy Space Center. The data they produce will complement and enhance the 
protection against abnormal flight and processing damage offered by current inspections. 

The normal RCC post-flight inspection requirements now consist of visual, tactile, and 
infrared thermography on the installed (i.e., in-situ) RCC components (wing leading edge 
panels, nosecap, and chin panel). Contingency inspections (eddy current, ultrasonic, 
radiography) will be performed if there are any suspicions of impact damage to the RCC by 
virtue of instrumentation, photographic, thermography, or visual post-flight inspection. 

RCC structural integrity and mass loss estimates were validated by off-vehicle non¬ 
destructive inspection of RCC components and destructive testing of flown wing leading edge 
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panels. All wing leading edge panels, seals, nosecaps, and chin panels were removed from 
Discovery , Atlantis , and Endeavour and returned to the Lockheed Martin facility in Dallas, 
Texas, for comprehensive non-destructive inspection. Inspections included a mix of 
ultrasonic, X-ray, and eddy current techniques. In addition, NASA has introduced off-vehicle 
flash thermography for all wing leading edge panels and accessible nosecap and chin panel 
surfaces; any questionable components are subjected to a CAT scan. This data will be used to 
support development of future in-situ non-destructive inspection techniques. 

In addition, three flown RCC panels with 15, 19, and 27 missions, respectively, have been 
destructively tested to determine actual loss of strength due to oxidation. The testing of this 
flown hardware to date confirms the conservativeness of the RCC material values used for 
design and projected mission life. 

The RCC Problem Resolution Team was also given approval for a plan to evaluate attach 
hardware through non-destructive inspection and destructive testing. Detailed hardware non¬ 
destructive inspection (dye penetrant, eddy current) to address environmental degradation 
(corrosion and embrittlement) and fatigue damage concerns have been performed on selected 
OV-103/104 WLE panels in the high heat and fatigue areas. No degradation or fatigue 
damage concerns were found. 



Jim Landy, a 
specialist with United 
Space Alliance, 
examines a wing 
leading edge 
reinforced carbon- 
carbon panel using 
flash thermography. 
A relatively new 
procedure at KSC, 
thermography uses 
high intensity light to 
heat areas of the 
panels. The panels 
are then immediately 
scanned with an 
infrared camera. As 
the panels cool, any 
internal flaws are 
revealed. 


3.2.4 RTF TG Assessment 

Members of the RTF TG conducted fact-finding at the Kennedy Space Center on September 
24, 2003. NASA submitted a closure package on April 7, 2004, and sufficient progress had 
been made for the Task Group to conditionally close this assessment at the April 16, 2004, 
public meeting. There were four conditions on the closure: an updated version of the 
Operations and Maintenance Requirements and Specifications Document, File 3, Volume 9, 
to include the inspection of the RCC panels, the closure of all Material Review and Problem 
Reports from the Discovery and Atlantis RCC non-destructive inspections, the receipt of 
PRCB Directive S064002 closing the NASA review of non-destructive inspection techniques, 
and the closure of the remaining RTG TG requests for information regarding impact test data. 
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As of December 2004, the RTF TG had received two of the items required for closure; the 
PRCB Directive and the RCC impact test data. The Operations and Maintenance 
Requirements and Specifications Document updated for inspection of RCC panels and closure 
packages for all MR/PRs from detailed RCC non-destructive inspection were delivered on 
February 2, 2005. 

One other item of concern to the Task Group, an anomaly discovered in the nosecap from 
Endeavour , was satisfactorily explained by NASA. The damage occurred during a sealant 
refurbishment process; other RCC had previously been subjected to the same process without 
incident. It was concluded that the nosecap had a latent manufacturing flaw and was not cause 
for concern about any of the RCC on Discovery. 

The RTF TG assessment of NASA’s actions was completed at the February 17, 2005 
teleconference meeting. The intent of CAIB Recommendation 3.3-1 has been met. 

3.2.5 RTF TG Observation 

The Task Group stresses that these inspections only verified the RCC against its original “as- 
built” manufacturing specifications and did not materially change the RCC or its impact 
resistance; this recommendation did not call for any change to the material. The original 
manufacturing specifications for RCC never envisioned the need for repair, nor were they 
written with the knowledge of the actual debris environment. This makes the elimination of 
debris shedding (R3.2-1) and Orbiter hardening (R3.3-2) all the more important. The Task 
Group also strongly endorses the continuation of non-destructive inspections of the RCC for 
the remainder of the Space Shuttle Program, the documentation of flight-to-flight inspections 
in the OMRSD, and the documentation of non-destructive inspection standards for RCC. 


Billy Witt, a midbody 
shop mechanic with 
United Space 
Alliance, checks a 
part used for 
installation of a 
reinforced carbon- 
carbon panel to the 
leading edge of the 
wing of an Orbiter. 
Note the insulation 
between the RCC 
panel and the 
wing spar. 
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3.3 CAIB Recommendation 3.3-2 - 
Orbiter Hardening 

Initiate a program designed to increase the Orbiter’s ability to sustain minor debris damage 
by measures such as improved impact-resistant Reinforced Carbon-Carbon and acreage tiles. 
This program should determine the actual impact resistance of current materials and the 
effect of likely debris strikes. 

3.3.1 RTF TG Interpretation 

Develop a detailed plan for an Orbiter hardening program including testing and modeling to 
determine the impact resistance of the Thermal Protection System. For the first Orbiter 
returning to flight, the actual impact resistance of installed material and the effect of likely 
debris strikes should be known. Implement hardware changes as defined in the hardening 
program. 


3.3.2 Background 

The Columbia accident clearly demonstrated that the Orbiter Thermal Protection System, 
including the reinforced carbon-carbon (RCC) panels and acreage tiles, was vulnerable to 
impact damage from the existing debris environment. As a result, the Columbia Accident 
Investigation Board (CAIB) issued recommendations to eliminate debris (R3.2-1), determine 
the structural integrity of the RCC (R3.3-1), harden the Orbiter (R3.3-2) against impacts, and 
to develop on-orbit repair capabilities (R6.4-1). 

The development of RCC by Ling-Temco-Vought (now Lockheed Martin Missiles and Fire 
Control) was key to meeting the wing leading edge requirements for the Orbiter Thermal 
Protection System. Each wing leading edge consists of 22 RCC panels, numbered from 1 to 
22 moving outward on the wing (the nomenclature is “5-left” or “5-right” to differentiate, for 
example, the two number 5 panels). Because the shape of the wing changes from inboard to 
outboard, each panel is unique. 

It had always been known that the impact resistance of the acreage tiles that cover the 
majority of the Orbiter was limited, but flight experience indicated the tiles could tolerate 
some damage. The reinforced carbon-carbon used on the nose and wing leading edges was 
thought to have better impact resistance and damage tolerance. The Columbia accident and 
subsequent testing revealed that the impact tolerances for both RCC and acreage tiles were 
lower than believed. In addition, careful examination of flight data revealed that the debris 
environment was somewhat worse than had been thought, with both foam and ice from the 
External Tank frequently impacting the Orbiter during ascent. 

3.3.3 NASA Implementation 

NASA selected 17 hardening options to be implemented in three phases. Based primarily on 
maturity and schedule, four projects were identified as Phase I options for implementation 
before return to flight: front spar “sneak flow” protection for the most vulnerable and critical 
RCC panels 5 through 13; main landing gear comer void elimination; forward Reaction 
Control System carrier panel redesign to eliminate bonded studs; and installing thicker outer 
thermal panes in side windows 1 and 6. 

NASA also selected two Phase II options for implementation after return to flight: “sneak 
flow” front spar protection for the remaining RCC panels 1 through 4 and 14 through 22, and 
the main landing gear door perimeter tile material change. Both of these Phase II projects are 
in the final design phase and will be executed during Orbiter Major Modification periods or 
during extended between-mission flows. 
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The 17 projects 
examined for Orbiter 
hardening, along 
with the associated 
phase for each and 
its status when this 
assessment was 
made. 


The new outer 
thermal panes 
installed in windows 
1 and 6 are 0.30- 
inch thicker than the 
original panes. This 
necessitated 
changing the 
Thermal Protection 
System tiles 
surrounding the 
windows. 


Since the Phase II and Phase III efforts are not directly related to the return to flight of 
STS-114, they are not covered in any more detail in this report. Further details of these 
efforts may be found in the NASA Implementation Plan. 


Family 

Redesign Proposal 

Phase 

1 

i Status 

WLESS 

“Sneak Flow” Front Spar Protection (RCC #5-13) 

1 

Installed/final cert approval pending 


“Sneak Flow” Front Spar Protection (RCC #1 - 4, 4 - 22) 

II 

Final cert approval pending 


Lower Access Panel Redesign/BR118 Tile Implementation 

III 

BRI-18 tile continues to be in qual & cert 


Insulator Redesign 

III 

On hold for higher priority arc-jet testing 


Robust RCC 

III 

Schedule and cost of implementing this option is 
not in sych with Agency’s vision to retire Shuttle in 
2010 

Landing Gear 
and ET Door 

Main Landing Gear Door Corner Void 

1 Installed/final cert approval pending 

Thermal Barriers 

Main Landing Gear Door Perimeter Tile Material Change 

11 

In Final Design phase 


Nose Landing Gear Door Thermal Barrier Material Change 

III 

In Assessment/lower priority to RTF 


External Tank Door Thermal Barrier Redesign 

III 

In Assessment/lower priority to RTF 

Vehicle Carrier 
Panels - Bonded 
Stud Elimination 

Forward RCS Carrier Panel Redesign - Bonded Stud Elimination 

1 

Installed/ final cert approval pending 

Side Windows 

Thicken Windows #1 and #6 

1 

Windows installed on OV-103 and OV-104/final cert 
approval pending 

Tougher Lower 
Surface Tiles 

Tougher Periphery (BR118) Tiles around MLGD, NLGD, ETD, 

Window Frames, Elevon Leading Edge and Wing Trailing Edge. 

III 

Qual & Cert in work. BR118 tile has been 
authorized for installation on all three Orbiters 


Tougher Acreage (BRI 8) Tiles and Ballistics SIP on Lower 

Surface. 

III 

Qual & Cert in work 

Instrumentation 

TPS Instrumentation 

III 

On-hold until post RTF 

Elevon Cove 

Elevon Leading Edge Carrier Panel Redesign 

III 

In Assessment/lower priority to RTF 

Tougher Upper 
Surface Tiles 

Tougher Upper Surface Tiles. 

III 

Development complete/ authorization pending for 
qual & cert 

Vertical Tail 

Vertical Tail AFSI High Emittance Coating 

111 ! 

This option will be eliminated since it only 
increases the Orbiter’s capability in the event of an 
abort during ascent. Trajectory can be designed to 
minimize vertical tail temperature. 


Existing_New design 



3.3.3.1 Impact and Damage Tolerance 

Using both test and analysis, the Orbiter Damage Impact Assessment Team determined the 
impact and damage tolerance of tile, RCC, and the Orbiter windows to External Tank foam, 
ice, and ablator debris. Impact tolerance is the ability of the Orbiter Thermal Protection 
System materials to withstand impacts before damage occurs. Damage tolerance is defined as 
the level of damage from a debris strike that can be tolerated while still safely completing the 
mission, especially entry. 
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Preliminary impact tolerance data was used as the basis for the ET Project’s work to certify 
the ET for foam debris generation. Subsequent test and analysis confirmed that the worst-on- 
worst damage tolerance of the tile and RCC was less than the ET certification limit. 



FIXED INSULATOR 


REMOVABLE INSULATOR 


FRONT WING SPAR 


SIP 


LOWER ACCESS 
PANEL 


SPAR 

FLOW RESTRICTOR 


SIP 


VIEW LOOKING AFT & INBOARD 
(RCC PANEL & FORWARD PARTS OMITTED ) 


Flow restrictors and 
additional insulation 
were added behind 
wing leading edge 
RCC panels 5 
through 13; the other 
panels will receive 
similar modifications 
after the return to 
flight. 


3.33.2 Tile Impact and Damage Tolerance 

Tests to determine TPS tile impact tolerance - using foam, ice, and ablator projectiles - have 
been completed at several field centers and other test facilities using both acreage and special 
configuration tiles, and both new and aged tiles. These tests indicated that, although tile is not 
very resistant to impact, it tolerates entry heating well even with damage. Overall, testing 
shows tile to be tolerant to moderate levels of impact damage; tile damage tolerance depends 
on tile thickness among other factors, which varies by location. As a result, certain areas of 
reduced thickness, such as those tiles adjacent to the main landing gear doors, are more 
susceptible to critical damage. Based on tests and on flight history, NASA developed and 
certified zone and cavity definitions for tile with similar structural and thermal characteristics 
to determine the depth of allowable damage penetration into the tile before critical damage 
occurs and repair is necessary. These zones take into account aerodynamic heating, impact 
angle, and tile thickness, but assume rectangular damage where the length and width 
dimensions are a function of depth. 



Since the heating 
loads vary across the 
Orbiter, the amount 
of damage that can 
be tolerated also 
varies. This chart 
shows the allowable 
depth of penetration 
into areas of acreage 
tiles that has been 
certified as safely 
tolerable. The red 
outline shows the 
region of large out of 
plane deflection 
(OOPD). 
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In addition, analysis of the Space Shuttle’s flight history indicated that tile damage fell into 
three impact classes: (1) numerous, shallow impacts primarily on the forward chine and 
fuselage; (2) fewer, deeper impacts primarily on the lower surface; and (3) umbilical area 
impacts. The majority of historical damage fell into the first category, and was likely caused 
by foam popcoming rather than large foam divots; increased ET intertank venting is expected 
to reduce popcoming masses in the ET foam. The second category of damage, with fewer 
deeper impacts, was most likely the result of ice from the ET bellows and brackets and ET 
foam divots; this category of damage is the most likely to require repair. Finally, the umbilical 
area had a mixture of both small and large impacts from a unique subset of sources including 
ET umbilical ice, baggies, Kapton tape, and ET fire detection paper. Debris transport analysis 
suggests that most of the impacts came from “local” sources rather than from the forward ET. 
As a result, NASA expects little change to the damage in the umbilical area. 


3.33.3 RCC Impact and Damage Tolerance 

Impact and damage tolerance testing on the RCC was performed at several NASA field 
centers and other test facilities, using both RCC “coupons” (small samples of material) and 
full-scale RCC panels. It was found that RCC is impact tolerant but not damage tolerant, since 
even minor cracks or coating loss can be critical and prevent safe entry. Structural and 
thermal testing of damaged RCC samples established how much damage can be tolerated and 
still allow a safe return for the crew and vehicle. Test-verified models established impact 
tolerance thresholds for foam and ice against tile and RCC. These impact tolerance thresholds 
are the levels at which detectable damage begins to occur. 


Each RCC panel 
was split into seven 
zones, and the level 
of damage that could 
be tolerated was 
evaluated for each 
zone. The zones on 
the bottom of the 
panel and the apex 
cannot tolerate any 
substantial damage 
due to the thermal 
environment these 
areas are subjected 
to during entry. 


Arc-jet testing showed that the RCC cannot tolerate any significant loss of coating from the 
front surface in areas that experience full heating on entry. This is of concern because impacts 

can create subsurface delamination of the 
RCC that is undetectable through imaging 
scans. Testing indicates that loss of front¬ 
side coating in areas that are hot enough to 
oxidize and/or promote full heating of the 
damaged substrate can cause unacceptable 
erosion damage in the delaminated areas. 
However, for subsurface delamination to be 
a concern there needs to be front-side 
damage, thus eliminating the concern of 
“hidden” damage. Further testing and 
modeling have shown that, although the 
hottest areas on the wing leading edge (the 
bottom and apex surfaces) cannot tolerate 
any significant coating loss, other cooler 
areas (such as the top surface of the wing 
leading edge) can tolerate some amount of 
coating loss and subsurface delamination. Testing and model development work has produced 
a map of the damage tolerance capabilities of the wing leading edge RCC depending on panel 
and location (top, apex, or bottom surface). 
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Testing is also complete on window impact from debris, including butcher paper, ablator 
material, foam, Tyvek®, aluminum oxide, and small/fast ogive foam. NASA’s debris transport 
analysis suggests that very small ogive foam has the potential to impact the Orbiter windows, 
but impact tolerance tests indicate that the windows can withstand these impacts without 
sustaining critical damage. Testing also indicated that butcher paper - used to cover the 
forward reaction control system thrusters at the launch pad - caused unacceptable damage to 
the windows. As a result, NASA replaced butcher paper covers with Tyvek covers (similar to 
what large FedEx® envelopes are made of) that will not cause critical damage. 
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3.33.4 Orbiter Hardening 

NASA has completed implementation of the four Phase I Orbiter hardening tasks. Beyond the 
return to flight, NASA will continue to pursue Phase II and III hardening options and will 
implement those that are feasible at the earliest possible opportunity. 

3.3.3 .5 Risk Assessment 

NASA identified, categorized, and assessed all known potential debris sources in order to 
assess the risk to the vehicle of debris. Most debris sources could be determined to be no 
threat to the Orbiter either because the debris was liberated before it gained enough velocity 
and kinetic energy to damage the Orbiter, was too small to be of concern (0.0002 lbm or less), 
or the transport analysis showed there was no path to take the debris from the source to any 
Orbiter structure. This left only a handful of debris sources of concern to be scrutinized and 
assessed for the potential to liberate debris that could cause critical damage to the Orbiter. 

The program’s “worst-on-worst” analysis of three of the remaining debris sources - acreage 
foam from the LH2 tank, L02 tank and the intertank - showed they would not shed foam that 
could cause more damage than the Orbiter could safely enter with. 

A Monte Carlo probabilistic analysis was done for five foam areas (L02/intertank ice/frost 
ramps, L02 tank to intertank flange, LH2 tank to intertank flange, L02 PAL ramp, and bipod 
closeout) and four ice locations (mid and aft feedline bellows, and forward and mid feedline 
brackets). There were two independent approaches for the Monte Carlo analysis: one for foam 
debris, which used physics-based models for foam liberation, and another for ice debris, 
which had to rely on engineered distributions based on a very limited set of test data for ice 
liberation. It is the Agency’s opinion that there is a great deal of conservatism in both 
approaches, but NASA has not been able to drive out the conservatisms from the models, 
mostly due to modeling limitations, a lack of time to generate ice-specific damage maps for 
tile, and limited test data not matching flight data. Each of the resulting probabilities for 
critical damage to RCC due to foam or ice liberation is less than 1 in 10,000; for tile, the 
probabilities range from 1 in 100 to 1 in 10,000. The four highest probabilities for critical 
damage to tile are for ice from the mid feedline bellows and second feedline bracket locations, 
and foam from the L02 ice/frost ramps and the L02 tank to intertank flange. 

NASA determined that the residual risk to several of the remaining areas was enveloped by 
the probabilistic assessments: the LH2 ice/frost ramp foam residual risk was enveloped by the 
L02/intertank ice/frost ramps, the LH2 PAL ramp by the L02 PAL ramp, and the three aft- 
most feedline bracket locations by the forward and mid feedline brackets. The potential for ice 
on the forward feedline bellows location was greatly reduced by the addition of a heater in 
that area, and the remaining ice that could form in that location will be controlled by launch 
commit criteria, documented in NSTS 08303, Ice/Debris Inspection Criteria. 

One debris source, ice around the umbilical doors, could not be shown by any means other 
than flight history to be an acceptable risk. NASA’s rationale for accepting this risk was that 
there is no transport mechanism to RCC or the windows and flight history showed that while 
there is a moderate amount of damage on most flights in this area, none has been severe. 

3.3.4 RTF TG Assessment 

members of the RTF TG conducted the first fact-finding trip for this recommendation on 
October 28-30, 2003, a trip to Southwest Research Institute (SwRI) to witness a foam “shoot” 
against an RCC wing leading edge panel. Additional fact-finding during 2004 included 
numerous Debris Summits, and the Task Group attended the Orbiter Design Certification 
Review on February 7-11, 2005. Members of the Task Group also attended a series of System 
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Design Certification Reviews and Design Verification Reviews for Debris from February 
through June, 2005, culminating in the (final) Debris DVR Board on June 24, 2005. Members 
also attended the Delta System DCR on June 23, 2005. 

This recommendation had two primary parts, Orbiter hardening and determining the impact 
resistance and the effect of likely debris strikes on the Orbiter TPS. Out of the Agency’s effort 
in the area of Orbiter hardening, a hardware program was initiated that provided some minor 
improvements that supported return to flight. The STS-114 improvements include thicker 
thermal panes for side windows 1 and 6, limited “sneak flow” front spar protection, main 
landing gear door corner void elimination, and modifications to the forward RCS carrier 
panel; additional items will be incorporated on later flights. A long-term program to provide 
robust RCC was dropped due to the decision to retire the Space Shuttle by 2010. 

The other part of this recommendation was a program to characterize the effects of debris 
strikes on the Orbiter Thermal Protection System. NASA embarked on a major effort toward 
that end. A program to determine the impact resistance of the TPS was performed and 
supported by a significant level of testing and analysis with independent peer reviews. Results 
from early testing and analysis were used to define ET debris allowable and Space Shuttle 
inspection criteria. As the testing and analysis effort matured, these early results were found 
to overestimate the impact and damage tolerances of the Orbiter TPS and a risk acceptance 
rationale had to be developed by the Space Shuttle Program. 

An extensive effort was made to model the effects of debris impacts and validate them against 
the available test data. These models will be used to assess damage sustained during flight. 
The foam assessments are reasonably well understood; however the Space Shuttle Program is 
struggling with understanding the effects of ice debris and had not finalized this effort when 
the Task Group’s assessment was completed. The NASA Engineering and Safety Center 
(NESC) stated at the June 24, 2005 Debris Verification Review Board, “Based on the 
available test data and analysis results, the NESC has concluded that the feedline brackets, 
bellows, and ET umbilical ice debris environment is not sufficiently characterized or 
understood to assign the level of risk. To establish the flight rationale for STS-114, additional 
work is required to develop adequate controls for ice.” 

The Orbiter is still vulnerable to the debris environment created by the External Tank. The 
Space Shuttle Program has acknowledged the possibility of critical debris damage and has 
accepted the remaining risk. 

The RTF TG concluded at the June 27, 2005, meeting that NASA did not meet the intent of 
CAIB Recommendation 3.3-2, in spite of tremendous effort by NASA and its contractors. 
Two reasons were cited: the present lack of a long-term approach to RCC hardening - an 
early long-term plan for Orbiter hardening was abandoned after the National Policy decision 
to retire the Space Shuttle fleet no later than 2010 - and the amount of remaining non¬ 
standard open work on ice debris, risk analysis, and verification of damage models. 

3.3.5 RTF TG Observation 

Although the Space Shuttle Program has performed an extensive effort to reduce debris for 
return to flight, there still is the potential - although reduced - for foam and ice to cause 
critical damage to the Orbiter; NASA will need to continue to reassess their accepted risk 
rationale flight-to-flight. 

3.3.6 RTF TG Minority Opinion 

The Technical Panel believes that, with the completion of the documented open work, the 
Space Shuttle Program met the intent of the CAIB recommendation. 
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3.4 CAIB Recommendation 3.4-1 - 
Ground-Based Imagery 

Upgrade the imaging system to be capable of providing a minimum of three useful views of 
the Space Shuttle from liftoff to at least Solid Rocket Booster separation, along any expected 
ascent azimuth. The operational status of these assets should be included in the Launch 
Commit Criteria for future launches. Consider using ships or aircraft to provide additional 
views of the Shuttle during ascent. 

3.4.1 RTF TG Interpretation 

The Columbia post-accident investigation was hampered by the lack of high-resolution 
imagery of the vehicle during ascent. The existing ground-based camera locations were a 
legacy of earlier programs and their locations were not optimized for the ascent trajectory of 
recent Space Shuttle missions. Further, due to equipment problems and a lack of clear 
requirements to maintain this equipment, imagery was not always usable, as was the case for 
the STS-107 launch. The Columbia Accident Investigation Board (CAIB) was concerned 
about the need to have an adequate number of appropriately-located cameras that operated 
properly to provide photographic coverage from more than one view of the Space Shuttle 
from launch through separation of the Solid Rocket Boosters. 

3.4.2 Background 

Of the dozen ground-based camera sites used to obtain images of the Space Shuttle during 
ascent, five were normally used to track the vehicle from liftoff until it was out of view. Due 
to view angles and atmospheric limitations, two sites did not capture the STS-107 debris 
event. Of the remaining three sites positioned to “see” at least a portion of the event, none 
provided a clear view of the actual debris impact to the wing. The first site lost track of 
Columbia during ascent, the second site was out of focus - because of an improperly 
maintained lens - and the third site captured only a view of the upper side of the left wing. 
The CAIB noted that camera problems had also hindered the Challenger investigation 17 
years earlier. Although the initial debris strike during STS-107 was discovered via image 
analysis, NASA’s post-launch evaluation of the impact was hampered by the lack of multiple 
views from high-resolution, high-speed ground cameras. The CAIB also found the quality of 
existing imagery - of all recent Space Shuttle launches - to be less than ideal. 



Long-range tracking 
camera (E-207) photo 
of STS-95 in October 
1998 atSRB 
separation shows the 
resolution limitations of 
ground tracking. 
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Multiple views of launch and ascent from varying angles provide important data for 
engineering assessment and the detection of unexpected anomalies. Images may also be used 
to assess debris shedding in flight, including the origin, size, and trajectory of the objects. 
Because of resolution limitations, however, this imagery is not intended to pinpoint the exact 
nature of potential damage to the vehicle. Finally, in keeping with the CAIB view that the 
Space Shuttle should be treated as a developmental flight vehicle, imagery assets should be 
used to measure its performance for the duration of the Space Shuttle Program. 

3.4.3 NASA Implementation 

A suite of improved ground-based and airborne cameras has been deployed to provide the 
ability to capture three complementary views of the Space Shuttle during launch and ascent. 
This will allow a better understanding of the ascent environment and the performance of the 
vehicle within this environment. Ground imagery may also allow the detection of ascent 
debris and identify potential damage locations on the Orbiter for detailed on-orbit assessment. 
There are four types of imagery that NASA will acquire from the ground cameras: 

• Primary imagery - film images used as the primary analysis tools for launch and 
ascent operations; 

• Fail-back imagery - back-up imagery (primarily 35mm and 16mm motion 
pictures) for use when the primary imagery is unavailable; 

• Quick-look imagery - digital imagery (primarily HDTV and SDTV) provided to 
the image analysis groups shortly after launch for initial assessments; and 

• Tracker imagery - imagery used to guide the camera tracking mounts and for 
analysis when needed. 

Although ground cameras provide important engineering data for the Space Shuttle, they are 
not intended to provide the resolution to identify the exact nature of any potential damage to 
the Orbiter. No real-time repair decisions will be directly based on this ascent imagery data. 
Instead, any anomalies identified using ground-based imagery assessments will be used to 
optimize the on-orbit inspections described in Section 3.13 (Recommendation 6.4-1). 

For the STS-114 launch, NASA has three short-range camera sites around the perimeter of the 
launch pad, seven medium-range camera sites, and nine long-range camera sites. Each of the 
medium- and long-range tracking cameras is independent, ensuring that no single failure can 
disable all of the trackers. Further, each of the film cameras on the trackers has a backup (fall¬ 
back), so no single camera failure eliminates a particular view. The locations of the new 
cameras and trackers are optimized for 51.6-degree-inclination launches since most, if not all, 
future Space Shuttle launches will be to the International Space Station. Previously, camera 
coverage was limited by a generic configuration originally designed for the full range of 
possible launch inclinations and ascent tracks envisioned early in the Space Shuttle program. 

Space Shuttle ascent imagery acquisition is divided into three overlapping periods with 
different requirements that provide for steps in lens focal lengths to maintain image resolution 
as the vehicle moves away from each camera location: 

• Short-range images (T-10 seconds through T+57 seconds); 

• Medium-range images (T-7 seconds through T+100 seconds); and 

• Long-range trackers (T-7 seconds or vehicle acquisition through 
T+165 seconds). 
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Left: Three short-range 
tracking sites are 
located around each 
LC-39 launch pad. 


Right: Medium-range 
tracking sites available 
for the Space Shuttle 
Program 



Long-range tracking 
sites located around 
the Kennedy Space 
Center. 


Currently, this capability nominally consists of 7.8-, 32-, 150-, and 400-inch focal length 
lenses. The theoretical limits of the optics under ideal conditions - assuming the object is not 
obscured by the exhaust plume and depending on orientation of vehicle to plane of film - 
provide: 


• Resolution to 1-inch size and 0.5-foot linear accuracy of debris source and 
impact location from lift-off to L+30 seconds along any expected azimuth; 

• Resolution to 3-inch size and 1-foot linear accuracy of debris source and impact 
location from L+30 seconds to L+60 seconds along any expected azimuth; 


Page 51 of 216 


















Final Report of the Return to Flight Task Group 


Range to target versus 
time for the two 
DOAMS long-range 
tracking sites. Only the 
Playalinda Beach 
DOAMS (E207) will be 
used for STS-114. The 
Cocoa Beach DOAMS 
(E208) is being moved 
to a new location at 
Patrick AFB and will not 
be used to support the 
first two launches. 


A DOAMS long-range 
tracking site. 


• Resolution to 8-inch size and 3-foot linear accuracy of debris source and impact 
location from L+60 seconds to L+90 seconds along any expected azimuth; 

• Resolution to 15-inch size and 5-foot linear accuracy of debris source and 
impact location from L+90 seconds to SRB separation (approximately 122 miles 
from the launch site) along any expected azimuth. 


Vehicle (STS-95) Range to Camera Site vs Time MET 



These images will be acquired by a combination of mobile Kineto Tracking Mount (KTM), 
Intermediate Focal Length Optical Tracking (IFLOT), and Advanced Transportable Optical 
Tracking System (ATOTS) platforms that can be optimally positioned for each flight based on 
launch azimuth and other considerations. In addition, the fixed-position Distant Object 
Attitude Measurement System (DOAMS) site at Playalinda Beach, operated by the Air Force 
45th Space Wing, will continue to be used for long-range observation. The “fuzzy” optics in 
the Cocoa Beach DOAMS noted by the CAIB has been corrected by the vendor, but the Air 
Force is in the process of moving this fixed installation several miles south to Patrick AFB to 
avoid high-rise condominiums that have been erected adjacent to the existing site, severely 
restricting the view of the launch areas; it will not be used to support STS-114. 



NASA is continuing to ship 14 existing trackers at the Kennedy Space Center to the White 
Sands Missile Range for refurbishment. This work will be ongoing until refurbishment of all 
trackers is complete in 2008. Trackers and optics will be borrowed from other ranges to 
support launches until the refurbished assets are redelivered. NASA is also procuring 
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additional cameras to provide increased redundancy and refurbishing existing cameras. NASA 
has ordered 35 fixed camera lenses to supplement the existing inventory and has purchased 
two KTM Digital Signal Processing Amplifiers to improve KTM reliability and performance. 
In addition, NASA has received 24 HDTV cameras to improve quick-look capabilities. 
Funding has also been approved to procure additional spare mounts, as well as to fund studies 
on additional capability in the areas of infrared and ultraviolet imagery, adaptive optics, and 
high-speed digital video. 




Long-range trackers at 
the Kennedy Space 
Center. 


During, and subsequent to, the accident investigation, there was considerable interest in 
whether video technology had evolved far enough to replace film as the primary imagery for 
Space Shuttle launches. The NASA Intercenter Photo Working Group (IPWG) compared the 
image resolution of several different types of image gathering systems and determined their 
theoretical maximum performance. 

Based on this analysis, NASA decided that the primary product for imagery analysis will 
continue to be film due to its resolution capability and dynamic range. The long-range 
tracking sites use 70mm cameras to track the Solid Rocket Boosters after separation and to 
provide “big sky” coverage of any major mishaps. All short- and medium-range tracking sites 
use 35mm cameras for optimum “resolution-on-media” as their primary imagery. Close-in 
fixed camera sites use high-speed (400 frames per second) 16mm film motion picture 
cameras. All short-, medium-, and long-range tracking sites use HDTV for a quick-look 
capability and as a backup to the primary 35mm or 70mm cameras. SDTV was not chosen as 
an analysis tool, but it will continue to be used by camera site operators for wide field-of-view 
target locating. SVHS demonstrated a poor resolution that made it unacceptable as an analysis 
tool, although budget constraints have forced its use in some limited instances. 


In addition to ground cameras, NASA approved the development and implementation of an 
aircraft-based imaging system known as the WB-57 Ascent Video Experiment (WAVE) to 
provide both ascent and entry imagery. 



B The two NASA 

high-altitude WB-57F 
aircraft have been 
modified with cameras 
to photograph the 
Space Shuttle during 
ascent. 
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The use of an airborne imaging system will provide opportunities to better observe the vehicle 
during days of heavier cloud cover and in areas obscured from ground cameras by the exhaust 
plume following launch. The use of two aircraft flying at an altitude of 60,000 feet will allow 
a wide range of coverage with each airplane providing imagery over a 400-mile path. A 
32-inch diameter ball turret in the nose of each WB-57F houses an optical bench that contains 
HDTV and infrared camera systems. The optics consists of a 4.2-meter fixed focal length lens 
that can be operated in both auto track and manual modes. 


Computer model showing 
the views expected from 
the WB-57 WAVE aircraft. 



The WAVE aircraft will be used on an experimental basis during the first two retum-to-flight 
launches (STS-114 and STS-121). Based on an analysis of the system’s performance and 
quality of the products obtained, NASA will make a decision on whether to continue use of 
this system on future flights. The Critical Design Review for the WAVE was completed on 
July 1, 2004 and the ball turrets were installed in early 2005. The HALO II Gulfstream 
aircraft operated for the Missile Defense Agency is available as a backup airborne tracking 
asset if needed. 

NASA also has assessed using ground based radar for identifying and tracking potential 
debris sources, and new C-band radar on North Merritt Island will be used on STS-114 to 
complement information obtained from the camera systems. 

In addition, NASA is revising the launch requirements and procedures to support an ability to 
capture three useful views of the Shuttle during ascent. Initially, NASA will limit launches to 
daylight hours in order to maximize the ability to capture the most useful ground ascent 
imagery. Camera and tracker operability and readiness to support launch will be supported by 
a new set of pre-launch equipment and data system checks. In addition to certification at the 
Flight Readiness Review, the status of the group imagery assets will be reviewed at the MMT 
Tanking Meeting (approximately L-l 1 hours) and within one hour of launch. The readiness of 
the camera sites will be reported to the Launch Director at T-20 minutes that will provide 
status to the MMT on the capability to capture three useful views. 
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3.4.4 RTF TG Assessment 

The NASA approach to the CAIB recommendation was to provide an integrated package that 
tied together all three imagery recommendations (R3.4-1, Ground-Based Imagery; R3.4-2, 
High-Resolution Images of External Tank; and R3.4-3, High-Resolution Images of Orbiter), 
and moved the on-orbit inspection capabilities to R6.4-1, Thermal Protection System 
Inspection and Repair. Ultimately, the Task Group decided to consider R3.4-1 and R3.4-2 as 
standalone packages, while R3.4-3 and the inspection portion of R6.4-1 were tightly coupled 
and their final assessments were considered together. 

NASA has made progress toward achieving an integrated suite of ground cameras to capture 
high-resolution images of the Space Shuttle during ascent and has significantly increased the 
number and capability of ground camera sites. Also, the Agency has arranged for airborne 
assets (WAVE) to mitigate the effects of cloud cover and improve higher altitude resolution, 
at least for the first two launches. From a hardware asset perspective, these changes should 
ensure an adequate capability to meet the CAIB intent for three useful views. 

The RTF TG believes that NASA is aware of the limitations inherent in its approach to 
ground imagery. Although the ground cameras provide important engineering data for the 
Space Shuttle during launch and ascent, they do not have the resolution necessary to 
definitively establish that the Orbiter has not suffered ascent debris damage. NASA has stated 
that they will not make any real-time repair decisions directly based on ground imagery data. 
Rather, the comprehensive assessments of Orbiter impacts and damage necessary to ensure 
the safety of the vehicle and crew will be conducted using on-orbit inspection and analysis, 
but focused by ground and ascent imagery. 

Numerous fact-finding activities were conducted by the Task Group beginning in October 
2003 through the closure meeting on November 30, 2004. This final meeting led the Task 
Group to conditionally close their assessment during the December 2004 plenary. The 
conditions included the closure of two requests for information, completing the required 
safety documentation, complete systems testing and verification, training of the operators on 
the new cameras and mounts, incorporating the Ground Imagery Project Summary into the 
overall Program Design Certification Review, completing the Critical Design Review action 
closeout, and completing the standard readiness review process. In addition, prior to return to 
flight, NASA stated that they would add a redundant power source to the system that operates 
the launch pad cameras. 

During a further fact-finding meeting held in January 2005, NASA, together with the 45th 
Space Wing, specified the participants and organizations responsible for certifying mission 
capability during the launch countdown, the reporting mechanisms to launch management for 
imagery asset status, and how the usability of imagery assets will be evaluated when weather 
obstructions exist. The relationship between the Kennedy Space Center and the 45th Space 
Wing on the Eastern Range was clarified, and the Task Group was satisfied that the correct 
agreements were in place between these organizations to ensure status reflecting the 
operability and readiness of assets during the launch countdown. 

Despite the significant progress made in installing and refurbishing the cameras around the 
launch complex, not all of work was able to be completed prior to retum-to-flight. NASA 
informed the Task Group that after the launch of STS-114 they will continue to refurbish the 
cameras and mounts per their existing plan, fly the WAVE aircraft in support of STS-121, and 
review the data from WAVE to determine if the concept should continue for future launches. 
Eventually, all borrowed assets will be replaced with planned procurements. 

It should be noted that there is a difference between the NASA implementation and the 
wording of the CAIB recommendation in how the requirements for the camera systems are 
documented. The CAIB wrote that “operational status of these assets should be included in 
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the Launch Commit Criteria for future launches .” NASA decided that including these systems 
in the Launch Commit Criteria document was inappropriate, and instead included the 
information in the Program Requirements Document with status reporting in the launch 
countdown procedure. While the Program Requirements Document includes launch support 
requirements, it, alone, does not require the MMT to consider the ground imagery assets as 
part of the launch decision process. A small part of the camera power system was included in 
the Launch Commit Criteria since its status affects multiple camera sites. The Task Group, 
while expressing some concerns, believed this approach was satisfactory. 

The RTF TG assessment of NASA’s actions was completed at the June 8, 2005, meeting. The 
intent of CAIB Recommendation 3.4-1 has been met. 

3.4.5 RTF TG Observations 

While the actions NASA has taken, for the most part, meet the letter of the CAIB 
recommendation, the RTF TG has the following observations: 

1. The approach to documenting the requirements provides launch management 
awareness of the status of these assets. However, it does not require a Launch 
Commit Criteria waiver to proceed with less than three useful views. 

2. The Shuttle should be treated as a developmental vehicle with its performance 
measured for all missions. Imagery has proven to be a useful tool for assessing the 
performance of the Space Shuttle during launch and ascent. Since a substantial 
amount of funds were expended to improve the capability to gather this imagery, 
NASA should retain these assets for the duration of the Space Shuttle Program. 


Workers prepare a 
WB-57F aircraft at 
Patrick AFB, Florida. 
The WAVE provides 
both ascent and 
entry imagery and 
enables better 
observation of the 
Space Shuttle on 
days of heavier 
cloud cover and 
areas obscured from 
ground cameras by 
the launch exhaust 
plume. WAVE 
comprises a 32-inch- 
ball turret system 
mounted on the nose 
that houses an 
optical bench, 
providing installation 
of both HDTV and 
infrared cameras. 
The system can be 
operated in both 
auto track and 
manual modes. 
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3.5 CAIB Recommendation 3.4-2 - 

High-Resolution Images of External Tank 

Provide a capability to obtain and downlink high-resolution images of the External Tank after 
it separates. 

3.5.1 RTF TG Interpretation 

Engineering quality imagery of the External Tank (ET) taken from Columbia after separation 
would have been of great significance in the accident investigation. High-resolution imagery 
of the External Tank should be obtained on each flight and downlinked to the ground as soon 
as practical after achieving orbit. 

3.5.2 Background 

At the time of the Columbia accident, the Orbiters had film cameras installed in each 
umbilical well to provide images of the External Tank following separation. Additionally, 
after ET separation, the Orbiter would be maneuvered into a position that permitted a 
crewmember to take images of the ET using a hand-held digital camera. Following landing, 
the film from the umbilical well cameras was removed and developed for evaluation; the 
hand-held digital camera was downloaded at the same time. These cameras provided images 
of sufficient quality and resolution to permit an engineering evaluation of the ET thermal 
protection system, including foam shedding. Unfortunately, none of these cameras were 
recovered from the Columbia debris. Therefore, no images of the External Tank were 
available to provide engineering insight into foam shedding and debris during the mission. 

3.5.3 NASA Implementation 

To provide the capability to downlink images of the External Tank after separation, NASA 
replaced the 35mm film camera in the Orbiter right umbilical well with a high-resolution 
digital still camera. This 6 megapixel camera uses a 35mm lens and provides a field-of-view 
only slightly smaller than the original film camera. Because of technical complexity and 
limited bandwidth during ascent, the images will not be downlinked in real-time. Rather, once 
the Orbiter is on-orbit and the laptop network is set up in the crew cabin, the images will be 
copied from the camera to a laptop computer then downlinked to the Mission Control Center 
using the existing Orbiter Ku-band link. 

In addition, the flight crew will continue to use a handheld digital still camera with a telephoto 
lens. The Orbiter pitch-over maneuver has been modified to occur sooner after ET separation 
to provide better images from the crew camera. The location where the camera is stowed in 
the crew cabin has also been changed to allow easier access by the crew. The data from the 
digital camera will be transferred to a laptop in the crew cabin and downlinked to Mission 
Control in the same manner as the umbilical well camera images. 




A digital still camera 
is being carried in 
the right umbilical 
well to photograph 
the External Tank as 
it separates. 
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These images will be used for quick-look analysis by the Mission Management Team to 
determine if any ET anomalies exist that require additional on-orbit inspections (see Section 
3.13, Recommendation 6.4-1). 

A feasibility study for the Orbiter umbilical well camera was initiated in September 2003 and 
the design reviews were completed in April 2004. Modifications to Discovery to support 
STS-114 began in May 2004, and the camera system function testing was completed in March 
2005. The umbilical well camera was installed during Orbiter processing in early April 2005. 

3.5.4 RTF TG Assessment 

The NASA approach to the CAIB recommendation was to provide an integrated package that 
tied together all three imagery recommendations (R3.4-1, Ground-Based Imagery; R3.4-2, 
High-Resolution Images of External Tank; and 3.4-3, High-Resolution Images of Orbiter), 
and moved the on-orbit inspection capabilities to R6.4-1, Thermal Protection System 
Inspection and Repair. Ultimately, the Task Group decided to consider R3.4-1 and R3.4-2 as 
standalone packages, while R3.4-3 and the inspection portion of R6.4-1 were tightly coupled 
and their final assessments were considered together. 

Fact finding was conducted by the Task Group on February 20, 2004, November 15, 2004, 
and during the closure meeting on November 30, 2004. This final meeting led the Task Group 
to close their assessment during the December 2004 plenary. 

Appropriate cameras have been selected to obtain quality views of the External Tank using 
both the handheld camera from the Orbiter and the digital umbilical well camera. The 
STS-114 crew has been trained in use of the hardware, and the digital umbilical well camera 
was installed before OV-103 rolled-out to the launch pad. 


The RTF TG assessment of NASA’s actions was completed at the December 16, 2004, 
meeting. The intent of CAIB Recommendation 3.4-2 has been met. 

3.5.5 RTF TG Observation 

It is our observation that the addition of the digital umbilical well camera to the overall suite 
of imagery planned for STS-114 was vital. This camera requires good lighting in order to 
provide high-quality images during separation. The views obtained from this imagery are, in 
our opinion, critical for evaluating the state of the modified External Tank. 


Image of the 
STS-106 External 
Tank taken by the 
umbilical well film 
camera after 
separation. NASA 
has replaced this 
camera with a digital 
camera so that 
images can be 
downlinked to the 
ground during the 
mission. The bipod 
ramps that used to 
be used on the ET 
are clearly visible. 
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3.6 CAIB Recommendation 3.4-3 - 

High-Resolution Images of Orbiter 

Provide a capability to obtain and downlink high-resolution images of the underside of the 
Orbiter wing leading edge and forward section of both wings’ Thermal Protection System. 

3.6.1 RTF TG Interpretation 

The Columbia Accident Investigation Board (CAIB) investigation was hampered by the lack 
of high-resolution images of the launch ascent trajectory. The only images available were 
from ground cameras that were inadequate in number, placement, and resolution to permit a 
meaningful and timely engineering analysis of the External Tank (ET) thermal protection 
system performance. 

3.6.2 Background 

The damage to the left wing of Columbia occurred shortly after liftoff, but went undetected 
for the entire mission. Although there was photographic evidence from ground cameras of a 
debris impact to the wing, the quality of the imagery hampered a thorough analysis of the 
debris and its potential damage. There was no on-board imagery of the debris strike. 

Many expendable launch vehicles carry cameras pointing toward various parts of the vehicle. 
Usually, these cameras monitor the separation of solid rocket motors, or provide public 
relations value only. Such a camera was mounted on the ET during STS-112 as an experiment 
(the so-called “ET-Cam”). The CAIB believed that this type of camera arrangement could 
provide valuable engineering data if aimed at areas of interest on the Orbiter, such as the main 
landing gear doors and wing leading edges. 



A digital camera has 
been added to the 
External Tank L02 
feedline fairing. 


3.6.3 NASA Implementation 

For the first few missions after return to flight, NASA will use primarily on-orbit inspections 
to meet the requirement to assess the health and status of the Orbiter Thermal Protection 
System. This is because the on-vehicle ascent imagery suite does not provide complete 
imagery of the underside of the Orbiter or guarantee detection of all potential impacts to the 
Orbiter. NASA’s detailed implementation of high-resolution images of the Orbiter was 
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presented with Recommendation 6.4-1. The two primary methods include Orbiter Boom 
Sensor System (OBSS) and the R-Bar Pitch Maneuver (RPM) imagery; see Section 3.13 
(R6.4-1) for a further discussion. 

In addition, NASA will have cameras on the External Tank liquid oxygen (L02) feedline 
fairing and the forward skirt of each Solid Rocket Booster. The ET L02 feedline fairing 
camera will take images of the ET bipod areas and the underside of the Orbiter fuselage and 
the right wing from liftoff through the first 15 minutes of flight. The new location of the ET 
camera will reduce the likelihood that its views will be obscured by the booster separation 
motor plume, a discrepancy observed on STS-112. These images will be transmitted to 
ground stations in real time. 

The SRB forward skirt cameras will take images from 3 seconds to 350 seconds after liftoff. 
These two cameras will look sideways at the ET intertank. The images from this location will 
be stored on the Solid Rocket Boosters and will be available after the SRBs are recovered, 
approximately three days after launch. 


Beginning with STS-115 (the third flight), NASA will introduce an additional complement of 
cameras on the SRBs: aft-looking cameras located on the SRB forward skirt and forward- 
looking cameras located on the SRB External Tank Attachment Ring. Together, these 
cameras will provide additional views of the underside of the Orbiter during ascent. 


STS-114 and 
STS-121 will carry 
cameras in the 
forward skirt of each 
Solid Rocket 
Booster, in the 
External Tank L02 
feedline fairing, and 
in the Orbiter 
umbilical well. In 
addition, the crew 
will continue to use 
hand-held cameras 
to photograph the ET 
after separation. 



3.6.4 RTF TG Assessment 

The NASA approach to the CAIB recommendation was to provide an integrated package that 
tied together all three imagery recommendations (R3.4-1, Ground-Based Imagery; R3.4-2, 
High-Resolution Images of External Tank; and 3.4-3, High-Resolution Images of Orbiter), 
and moved the on-orbit inspection capabilities to R6.4-1, Thermal Protection System 
Inspection and Repair. Ultimately, the Task Group decided to consider R3.4-1 and R3.4-2 as 
standalone packages, while R3.4-3 and the inspection portion of R6.4-1 were tightly coupled 
and their final assessments were considered together. 


NASA addressed the Orbiter Boom Sensor System (OBSS) and the R-Bar Pitch Maneuver 
(RPM) as part of CAIB Recommendation 6.4-1. However, these are the capabilities that 
provide evidence that this recommendation has been met and are assessed here. 
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Inside the Orbiter 
Processing Facility 
bay 3 at the 
Kennedy Space 
Center, Discovery’s 
payload bay doors 
are ready to be 
closed. Seen in the 
center (starboard 
side) and at right are 
the new Orbiter 
Boom Sensor 
System (OBSS) and 
the Shuttle Remote 
Manipulator System 
(SRMS). The black 
object in the 
foreground is the 
Ku-band antenna. 


Numerous fact-finding activities were conducted between October 2003 and the closure 
meeting on November 30, 2004. NASA provided a partial closure package for R3.4-3 
concurrently with R3.4-1 and R3.4-2, the other imagery recommendations, and the closure 
presentation covered all three recommendations. However, since NASA moved their 
implementation of the OBSS and the R-Bar Pitch Maneuver into R6.4-1, the Task Group did 
not feel it could close R3.4-3 until the closure package for R6.4-1 was received. 


The closure package for R6.4-1 was received on May 26, 2005. Although the Task Group did 
not feel that the repair portion of the closure package were sufficient to deliberate R6.4-1, the 
portion of the package concerning inspection was complete and R3.4-3 was deliberated at the 
June 8, 2005, plenary meeting in Houston. 


The closure package showed that the primary tool for imaging the wing leading edge on orbit 
will be with the Orbiter Boom Sensor System. There are two sensor packages on the OBSS: 
the laser dynamic range imager (LDRI), which will be used on the lower surface and apex of 
the wing leading edge, and the laser camera system (LCS), which will be used primarily on 
the nosecap. The LDRI has demonstrated, under laboratory conditions, the ability to resolve 
0.25-inch holes and 0.015-inch cracks, while the LCS has shown the ability to resolve 0.125- 
inch holes and 0.25-inch coating loss. The Task Group questions whether these resolutions 
can actually be achieved on orbit, and they do not necessarily correspond to the smallest 
critical damage the RCC can withstand; nevertheless they are a significant capability. 


There are some questions remaining regarding the Orbiter Boom Sensor System, which must 
be resolved operationally. These include the clearance between the OBSS and the Ku-band 
antenna in the retracted position, and analysis of LDRI cable clearance with the Orbiter 
radiator and CMG payload. NASA assures the Task Group that these items will not affect the 
operation of the OBSS during STS-114. 


The primary method for imaging the acreage tiles on the bottom of the Orbiter and the surface 
insulation on top of the Orbiter will be via photography from the ISS during the R-Bar Pitch 
Maneuver while the Orbiter is approaching the station to dock. These images provide 
adequate resolution to initiate a more-focused inspection using the OBSS, if required. 

The RTF TG assessment of NASA’s actions was completed at the June 8, 2005, meeting. 
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With the provision that the forward work, described previously, is completed, the Task Group 
feels that the intent of CAIB Recommendation 3.4-3 has been met. 

3.6.5 RTF TG Observation 

The Task Group believes that on-vehicle ascent imagery will be a valuable source of 
engineering, performance, and environment data and will be useful for understanding in-flight 
anomalies. The new location of the ET camera should reduce the likelihood that the camera 
will be obscured by the booster separation motor plume. The RTF TG cautions, however, that 
this on-vehicle ascent imagery suite does not provide complete imagery of the underside of 
the Orbiter or guarantee detection of all potential impacts to the Orbiter. 

The certified resolution of the OBSS sensor suite does not meet critical damage size criteria. 


NASA has committed to retain an on-orbit inspection capability after the OBSS can no longer 
be flown. The RTF TG strongly endorses that commitment. 


The 50-foot long 
OBSS attaches to 
the end of the SRMS 
and provides the 
capability to inspect 
all of the RCC on the 
Orbiter as well as 
most of the 
underside tiles. 



The OBSS boom is 
very similar to the 
standard Remote 
Manipulator System 
boom the Orbiter has 
carried on most of its 
missions. The RMS 
attaches to the 
OBSS and provides 
power and control to 
the new boom. Two 
new imaging 
systems are located 
at the end of the 
OBSS. 
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3.7 CAIB Recommendation 4.2-1 - 

Solid Rocket Booster Bolt Catcher 

Test and qualify the flight hardware bolt catchers. 

3.7.1 RTF TG Interpretation 

The meaning of the CAIB recommendation is clear. 

3.7.2 Background 

A fault tree review conducted for the Columbia Accident Investigation Board (CAIB) 
uncovered a significant problem with the Solid Rocket Booster (SRB) bolt catchers. Each 
SRB is connected to the External Tank (ET) by four separation bolts: three at the bottom plus 
a larger one at the top that weighs approximately 65 pounds. These larger upper (or 
“forward”) separation bolts (one on each SRB) and their associated bolt catchers on the 
External Tank were the subject of a great deal of scrutiny by the CAIB. 

About two minutes after launch, pyrotechnic charges break each forward separation bolt into 
two pieces, allowing the spent SRBs to separate from the External Tank. Two “bolt catchers” 
on the ET each trap the upper half of a fired separation bolt, while the lower half stays 
attached to the Solid Rocket Booster. As a result, both halves are kept from flying free of the 
assembly and potentially hitting the Orbiter. Bolt catchers have a domed aluminum cover 
containing an aluminum honeycomb matrix that absorbs the energy of the fired bolt. The two 
upper bolt halves and their respective catchers subsequently remain connected to the External 
Tank, which burns up during reentry, while the lower halves stay with the Solid Rocket 
Boosters that are recovered from the ocean. 

If one of the bolt catchers had failed during STS-107, the resulting debris could have damaged 
the wing leading edge of Columbia. Concerns that the bolt catchers may have failed, causing 
metal debris to ricochet toward the Orbiter, arose because the configuration of the bolt 
catchers used on Space Shuttle missions differed in important ways from the design used for 
the initial qualification tests. Despite the extensive CAIB analyses, the accident board also 
was not able to determine that the SRB bolt catchers, while an unlikely cause, could be 
definitively excluded as a potential cause the damage that doomed Columbia. 

Static and dynamic testing, conducted as a result of the CAIB inquiries, demonstrated that the 
bolt catchers flown on STS-107 had a factor of safety of 0.956, rather than 1.4 as required by 
specification. The CAIB and NASA also identified additional reasons to be concerned about 
the bolt catchers. The bolt catchers did not meet their established requirements; specifically, 
the thermal protection system for the assembly was not qualified for the separation shock 
environment; failures of the bolt catcher attach fasteners or inserts could lead to debris; and 
the ejection effects of the NASA standard initiator (NSI) from its pressure cartridge during 
bolt firing were not included in the original bolt catcher qualification. 

3.7.3 NASA Implementation 

The bolt catcher assembly and related hardware has been redesigned. The bolt catcher 
housing is now fabricated from a single-piece aluminum forging that removes the weak point 
at the weld from the original design. The strength of the housing has been increased by 
doubling the thickness and using a stronger aluminum. Further, NASA has redesigned and 
resized the bolts and inserts that attach the bolt catcher to the ET, using larger and stronger 
fasteners. The housing design was enhanced with an integral O-ring carrier design that 
eliminated a separate carrier and one O-ring. The assembly’s thermal protection system is 
replaced by machined cork with enhanced adhesion properties to reduce the potential for 
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debris, and a new honeycomb energy absorber was introduced to reduce the loads. Mandatory 
government inspection points have been added for the thermal protection system, structure, 
and energy absorber with 100-percent surveillance of all manufacturing processes during final 
assembly. This new assembly was qualified by testing as a complete system to demonstrate 
compliance with NASA factor-of-safety and debris requirements. 


The bolt catchers 
were extensively 
redesigned after 
STS-107, and 
subjected to a full- 
range of qualification 
testing. 


Bolt Catcher Design 



STS-107 Bolt Catcher Design 


TPS material 

SLA-561 
Machined Cork 


Housing 

2 pc. welded; 2219 Al; 1/8 in. thick 
1 pc.; 7050 Al; 1/4 in. thick 


Energy Absorber 
Spiral Wound 5052 Al; 
1400 psi crush; 

10 holes drilled 
5052 Al Honeycomb; 
828 psi crush 

Fasteners 

A286; 3/8 in.; 180 ksi 
MP35N; 9/16 in.; 260 ksi 


i-ring Carrier 

Separate 
Integrate' 


STS-114 Bolt Catcher Redesign 


The forward ET-SRB 
separation bolt is 
broken in half when 
the SRBs are 
jettisoned. It is the 
ET half of this bolt 
that the bolt catchers 
are intended to 
capture. 



NASA has completed the redesign of the bolt catcher assembly and its associated hardware. 
Critical Design Reviews were completed for both the bolt catcher and the NSI pressure 
cartridge in May 2004. Development testing completed to date includes: energy absorber 
characterization; bolt catcher system drop and firing test; bolt catcher structural tests; bolt 
catcher attachment fastener prying and bending test; separation bolt velocity determination; 
NSI pressure cartridge and retention device quick look margin tests; NSI pressure cartridge 
burst tests; and NSI pin ejection simulations. Thermal protection system qualification testing 
was completed in August 2004. 

Qualification testing of the bolt catcher assembly, to the original specifications, was begun in 
July 2004. During the final qualification test simulating NSI pin ejection firing, results 
showed that the actual crush depth was less than the predicted crush depth. (Crush depth is the 
measurement of the distance the bolt travels into the energy absorber inside the bolt catcher.) 
The difference between actual and predicted crush depth was determined to be caused by 
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Polymer Development Laboratories (PDL) foam and the energy absorber counterbore. In 
order to improve crush depth prediction accuracy, the PDL foam and energy absorber 
counterbore were eliminated by reducing the length of the energy absorber. Testing shows 
this reduction in length is acceptable because the longer energy absorber was added before the 
maximum bolt velocity was established. Subsequent testing proved that the bolts have a lower 
maximum velocity than the design allows; therefore shortening the energy absorber does not 
alter the effectiveness of the bolt catcher. However, it does allow for greater predictability of 
crush depth. Qualification testing was completed in October 2004. 



3.7.4 RTF TG Assessment 

The RTF TG conducted multiple fact-finding trips 
in support of the bolt catcher recommendation. The 
Task Group also supported several design reviews, 
including the Delta Critical Design Review (CDR) 
on April 28-30, 2004, and the Design Certification 
Review on November 22, 2004. 



The bolt catchers for 
ET-120, originally 
intended for use on 
STS-114, during their 
installation at the 
Kennedy Space 
Center. The bolt 
catchers used on 
ET-121, the tank 
actually used for 
STS-114, were 
identical. 


The bolt catcher for the SRB to ET separation bolt has been modified to provide an adequate 
safety factor, per the original specification. The STS-107 design was a two-piece welded 
assembly and the new design is based on a one-piece forging. The energy absorber used to 
attenuate the bolt impact load has been redesigned as well. Additionally, the thermal 
protection system has been changed from a sprayed-on material to bonded cork. The NASA 
standard initiator in the pressure cartridge had exhibited an ejection failure mode during 
several tests which could damage the energy absorber prior to bolt impact. This issue has been 
addressed by the incorporation of a locking ring assembly to aid in retention of the NSI. 


The SRB bolt catcher has successfully completed qualification testing and has demonstrated a 
minimum structural factor of safety of 1.86. The new assembly was qualified by testing as a 
complete system to demonstrate compliance with NASA factor-of-safety and debris 
requirements. Additionally, the NSI retention device has been determined to exhibit a 
minimum factor of safety of 2.3. The redesigned bolt catcher has successfully completed 
Level IV DCR. 

The RTF TG assessment of NASA’s actions was completed at the December 16, 2004 
meeting. The intent of CAIB Recommendation 4.2-1 has been met. 
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Discovery being 
lifted onto the stack 
originally intended 
for use during 
STS-114. Anomalies 
with this External 
Tank forced the 
eventually switch to 
the stack planned for 
use on STS-121. 
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3.8 CAIB Recommendation 4.2-3 - 
Two-Person Closeout Inspections 

Require that at least two employees attend all final closeouts and intertank area hand¬ 
spraying procedures. 

3.8.1 RTF TG Interpretation 

The Columbia Accident Investigation Board (CAIB) subsequently clarified that this 
recommendation was intended to apply across the entire Space Shuttle Program for all types 
of closeouts; although the External Tank (ET) intertank was specifically called out, the 
recommendation was not intended to be limited to this area. The RTF TG therefore 
interpreted this recommendation to mean that NASA should review and update all of their 
process controls to ensure that at least two people observe all final closeout activities in 
critical areas. 

3.8.2 Background 

In its report, the CAIB remarked on the Agency’s overall success in improving security 
following September 11, 2001. At that time, NASA embarked upon a comprehensive review 
of all security procedures in place and all Space Shuttle Program projects and elements 
cooperated with their host Centers and NASA Headquarters, Office of Security Management 
and Safeguards, to review NASA and contractor security procedures and implementing a wide 
array of improvements. This review encompassed the entire scope of security-oriented 
activities, including hiring procedures, personnel reliability assurance programs, physical site 
security, specific anti-terrorism measures, and manufacturing and processing procedures. 

The CAIB report (pp. 93-94) provides additional detail into the possibility that willful damage 
contributed to the STS-107 accident. The accident board’s investigation determined that this 
was not a credible potential cause of intertank foam debris. 

During this security review, however, the CAIB identified several processes that did not 
require two people to be present when an area on the flight vehicle was closed-out. Although 
unlikely, this could allow an individual to sabotage the vehicle without being observed. 
Equally as important, this was counter to the general policy of “two sets of eyes are better 
than one” that provides additional technical and safety checks during closeouts. 

3.8.3 NASA Implementation 

The External Tank Project amended all manufacturing processes and procedures to ensure 
that at least two employees, and in most cases several more, are present at all manufacturing 
steps. This includes manual foam applications and all other closeouts, both at Michoud 
Assembly Facility and the Kennedy Space Center. Furthermore, NASA implemented more- 
stringent quality assurance requirements and provided additional employee training, 
certification, and work documentation of inspections and imagery. 

In response to additional guidance provided by the RTF TG in April 2004, NASA widened 
the scope of its corrective measures by issuing additional direction for all major flight 
hardware and ground processing elements to conduct an audit of their final closeout 
procedures and protocols. The audit included a review of quality assurance closeout protocols 
and the protection they offer against willful damage. This audit was completed on April 30, 
2004 and the results forwarded to the Task Group shortly afterward. 
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In the back of the 
Orbiter Processing 
Facility bay 3, 
workers check one of 
the thermal 
protection system 
blanket ground wires 
to ensure a proper 
ground between the 
blanket and the 
Orbiter Boom Sensor 
System (OBSS). The 
installation will 
conclude TPS 
closeout prior to 
installation of the 
boom in Discovery. 
At least two workers 
are present for all 
closeout activities. 



3.8.4 RTF TG Assessment 

The Task Group conducted several fact-finding activities during early 2004. A closure 
package was received by the RTF TG in time for this recommendation to be considered at the 
April 2004 plenary meeting. The Task Group assessed the Agency’s implementation of this 
recommendation and determined that NASA was defining the accident board’s intent too 
narrowly. The Task Group’s fact-finding site visits, review of the CAIB report, and 
correspondence with members of the CAIB, led them to suggest that NASA should widen its 
perspective to include all flight hardware elements, rather than just the External Tank. 
Nevertheless, sufficient progress had been made for the Task Group to conditionally close 
their assessment at the April 16, 2004, public meeting. 


Accordingly, NASA widened the scope of its corrective effort to conduct a program-wide 
audit of all final closeouts for major flight hardware elements, both at the manufacturing sites 
and at the Kennedy Space Center. This audit was completed on April 30, 2004, and all revised 
requirements were incorporated into the appropriate documentation by January 2005. 

The results from this audit were received by the RTF TG on December 8, 2004, and the 
results presented in the closure package were considered satisfactory. NASA provided data on 
the documentation that had been updated, also to the Task Group’s satisfaction. 

The RTF TG assessment of NASA’s actions was completed at the December 16, 2004 
meeting. The intent of CAIB Recommendation 4.2-3 has been met. 
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3.9 CAIB Recommendation 4.2-5 - 

KSC Foreign Object Debris Definition 

Kennedy Space Center Quality Assurance and United Space Alliance must return to 
straightforward, industry-standard definition of Foreign Object Debris ” and eliminate any 
alternate or statistically deceptive definitions like “processing debris. ” 

3.9.1 RTF TG Interpretation 

During their investigation and interviews with personnel involved with processing the Space 
Shuttle for flight, the Columbia Accident Investigation Board (CAIB) determined that during 
January 2001 the Kennedy Space Center (KSC) generated new and non-standard definitions 
for Foreign Object Debris (FOD) which were fully implemented at KSC in June 2002. The 
term “processing debris” was applied to debris found during the routine processing of the 
flight hardware. The term FOD applied only to debris found in flight hardware after final 
closeout inspections. These definitions were unique to the Space Shuttle Program at the KSC. 
Because debris of any kind has critical safety implications, these definitions are important. 
Accordingly, the CAIB wanted the standard, industry-wide definitions reestablished for FOD. 

3.9.2 Background 

Problems with the Kennedy Space Center and United Space Alliance (USA) Foreign Object 
Damage Prevention Program, which in the Department of Defense and aviation industry 
typically falls under the auspices of Quality Assurance, were related to changes made during 
2001. In that year, Kennedy Space Center and United Space Alliance redefined the single 
term “Foreign Object Damage” - an industry-standard term - into two categories: “Processing 
Debris” and “Foreign Object Debris.” 

Processing Debris: 

Any material, product, substance, tool or aid generally used during the processing of 
flight hardware that remains in the work area when not directly in use, or that is left 
unattended in the work area for any length of time during the processing of tasks, or 
that is left remaining or forgotten in the work area after the completion of a task or 
at the end of a work shift. Also any item, material or substance in the work area that 
should be found and removed as part of standard housekeeping, Hazard Recognition 
and Inspection Program (HRIP) “walk-downs ”, or as part of “Clean As You Go ” 
practices. 

Foreign Object Debris: 

Processing debris becomes FOD when it poses a potential risk to the Shuttle or any 
of its components, and only occurs when the debris is found during or subsequent to 
a final/flight Closeout Inspection, or subsequent to OMI S0007 ET Load SAF/FAC 
“walk-down. ” 

These definitions were inconsistent with those of other NASA Centers, the Department of De¬ 
fense, commercial aviation, and National Aerospace FOD Prevention, Inc., guidelines. 
Because debris of any kind has critical safety implications, the CAIB believed these 
definitions were important. 

3.9.3 NASA Implementation 

The Kennedy Space Center and United Space Alliance have changed work procedures to 
consider all debris equally important and preventable. Rigorous definitions of FOD that are 
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the industry standard have been adopted. These new definitions adopted from National 
Aerospace FOD Prevention, Inc. guidelines and industry standards include Foreign Object 
Debris, Foreign Object Damage, and Clean-As-You-Go. FOD is redefined as “a substance, 
debris or article alien to a vehicle or system which would potentially cause damage.” 

The new FOD program is anchored in three fundamental areas of emphasis. First, it 
eliminates various categories of FOD, including “processing debris,” and treats all FOD as 
preventable and with equal importance. Second, it reemphasizes the responsibility and 
authority for FOD prevention at the operations level. FOD prevention and elimination are 
stressed and the work force is encouraged to report any and all FOD found by entering the 
data in the FOD database. This activity is performed with the knowledge that finding and 
reporting FOD is the goal of the Program and employees will not be penalized for their 
findings. Third, it elevates the importance of comprehensive independent monitoring by both 
contractors and the Government. 

United Space Alliance has also developed and implemented new work practices and 
strengthened existing practices. This new rigor will reduce the possibility for temporary 
worksite items or debris to migrate to an out-of-sight or inaccessible area, and it serves 

an important psychological purpose in 
eliminating visible breaches in FOD 
prevention discipline. 

The new FOD program has a meaningful set 
of metrics to measure effectiveness and to 
guide improvements. FOD walkdown 
findings will be tracked in the Integrated 
Quality Support Database. This database 
will also track FOD found during closeouts, 
launch countdowns, post-launch pad 
turnarounds, landing operations, and NASA 
quality assurance audits. “Stumble-on” 
FOD findings will also be tracked, as they 
offer an important metric of program 
effectiveness independent of planned FOD 
program activities. For all metrics, the types of FOD and their locations will be recorded and 
analyzed for trends to identify particular areas for improvement. Monthly metrics reporting to 
management will highlight the top five FOD types, locations, and observed workforce 
behaviors, along with the prior months’ trends. Continual improvement will be a hallmark of 
the revitalized FOD program. 

The implementation of the new program began on July 1, 2004, although many aspects of the 
plan existed in the previous FOD prevention program in place at KSC. Assessment audits by 
NASA and United Space Alliance were conducted beginning in October 2004. Corrective 
Action Plans have been established to address the findings and observations identified during 
the two audits. Schedules for the verification of the actions taken and for verifying the 
effectiveness of the corrective actions have been established to ensure the ongoing 
effectiveness of the FOD prevention program. Continual improvement will be vigorously 
pursued for the remainder of the life of the Space Shuttle. 

3.9.4 RTF TG Assessment 

The FOD Program at the Kennedy Space Center was very effective in the past. When the 
definitions were modified during 2001 to create multiple categories of debris, the workforce 
was not sufficiently trained to understand the implications. This confusion was expressed to 
the CAIB members during their interviews with KSC personnel; in response to the CAIB 
recommendation, KSC reevaluated the entire program. The Task Group concluded fact- 
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finding during a technical interchange meeting at KSC in May 2004. This complemented 
previous meetings with KSC quality assurance and United Space Alliance personnel in late 
2003 and early 2004. 

The Kennedy Space Center and United Space Alliance have changed the definition of 
“Foreign Object Debris” to be consistent with the recognized and accepted industry standard. 
Further, they have removed the misleading category of processing debris that caused concern. 
They have improved the training of the workforce, and obtained buy-in at all levels for both 
NASA and all contractors. The revised program has implemented several improvements 
above and beyond the expectations defined in the CAIB recommendation. The FOD database 
has been made significantly more robust and captures a higher level of reporting detail than 
existed previously. NASA management has demonstrated their buy-in with participation in 
“walk-downs” to inspect for FOD. 


The RTF TG initial assessment of NASA’s actions was completed at the July 22, 2004, 
teleconference plenary where the assessment was conditionally closed. After receiving audit 
results and specified corrective actions from NASA, the assessment was closed at the 
December 16, 2004, meeting. The intent of CAIB Recommendation 4.2-5 has been met. 

3.9.5 RTF TG Observation 

It is very important for NASA management to provide positive incentives for the reporting of 
FOD and to avoid negative sanctions for those who self-report. The Task Group believes 
management is sufficiently sensitive to this need and will provide the proper positive and 
negative feedback to the workforce. Metrics defined and tracked by NASA will assure 
continued compliance with the new improved FOD program. 



Discovery during 
early processing for 
STS-114. The 
reinforced carbon- 
carbon nosecap had 
been removed and 
returned to the 
vendor for testing. 
Note the open nose 
landing gear door at 
the bottom left. 
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The Crawler- 
Transporter drives 
away after delivering 
Discovery on her 
Mobile Launch 
Platform to Launch 
Complex 39B. 
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3.10 CAIB Recommendation 6.2-1 - 
Consistency with Resources 

Adopt and maintain a Shuttle flight schedule that is consistent with available resources. 
Although schedule deadlines are an important management tool, those deadlines must be 
regularly evaluated to ensure that any additional risk incurred to meet the schedule is 
recognized, understood, and acceptable. 

3.10.1 RTF TG Interpretation 

The Columbia Accident Investigation Board (CAIB) explicitly recognized the legitimate use 
of schedules to drive a process. They were concerned, however, that the line between 
“beneficial” schedule pressures and those that become detrimental, cannot be easily defined or 
measured. In the case of Columbia , the CAIB discovered that pressure on the Space Shuttle 
Program was created by the schedule for construction of the International Space Station. 
Indeed, the planned February 2004 completion of Node 2 of the International Space Station 
was being touted as a measure of NASA’s ability to maintain a schedule. 

The CAIB further observed that budget constraints inherently intensify the conflicts between 
schedule and safety. The meaning of the first sentence of the CAIB recommendation is clear: 
adjust the schedule to fit the available resources. 

3.10.2 Background 

During the course of the Columbia investigation, the CAIB received several unsolicited 
comments from NASA personnel regarding pressure. Oddly, the pressure was to meet a date 
more than a year after the launch of STS-107 that seemed etched in stone: February 19, 2004, 
the scheduled launch of STS-120. This flight was a milestone in the minds of NASA 
management since it would carry a section of the International Space Station called “Node 2” 
that would signal “U.S. Core Complete.” 

At first glance, the U.S. Core Complete date seemed noteworthy but unrelated to the 
Columbia accident. However, as the investigation continued, it became apparent to the 
accident board that the political mandates surrounding the International Space Station 
Program, as well as the Space Shuttle Program management’s responses to them, resulted in 
pressure to meet an increasingly ambitious launch schedule. 

Meeting U.S. Core Complete by February 19, 2004 - a date the CAIB found was promised by 
NASA management to the White House and Congress - would require launching 10 Space 
Shuttle missions in less than 16 months. With the focus on retaining political support for the 
International Space Station Program, little attention was paid to the effects the aggressive 
Node 2 launch date would have on the Space Shuttle Program. After years of downsizing and 
budget cuts, this mandate introduced elements of risk, and the high-pressure environments 
created by NASA Headquarters unquestionably affected Columbia , even though it was not 
flying to the International Space Station. 

After considering what they had uncovered during their investigation, the CAIB concluded: 

“The agency’s commitment to hold firm to a February 19, 2004, launch date for 
Node 2 influenced many of decisions in the months leading up to the launch of 
STS-107, and may well have subtly influenced the way managers handled the 
STS-112 foam strike and Columbia's as well. 

“When a program agrees to spend less money or accelerate a schedule beyond what 
the engineers and program managers think is reasonable, a small amount of overall 
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risk is added. These little pieces of risk add up until managers are no longer aware of 
the total program risk, and are, in fact, gambling. Little by little, NASA was 
accepting more and more risk in order to stay on schedule.” 

3.10.3 NASA Implementation 

NASA has strengthened a risk management system that it believes balances technical, 
schedule, and resource risks to achieve safe and reliable operations. Under this system, safety 
is ensured by first focusing on the technical risks and taking the time and financial resources 
necessary to properly resolve them. Once technical risks are reduced to an acceptable level, 
program managers turn to the management of schedule and resource risks to preserve safety. 

Among the activities NASA plans to undertake are more routinely assessing schedule risk, 
incorporating additional margin into the schedule and manifest to accommodate changes, and 
revising databases so schedule and risk indicators can be assessed by managers in real-time. 
KSC and United Space Alliance management use the Equivalent Flow Model (EFM) to plan 
resources that are consistent with the Space Shuttle flight schedule and available workforce 
needed to meet the technical requirements. The EFM is a computerized tool that uses a 
planned manifest and past performance to calculate processing resource requirements. The 
workforce, a primary input to the EFM tool, comprises fixed resources, supporting core daily 
operations, and variable resources that fluctuate depending on the manifest. Using past 
mission timelines and actual hours worked, an “equivalent flow” is developed to establish the 
required processing hours for a processing flow. 

To assess and manage the manifest, NASA has developed a process called the Manifest 
Assessment System that incorporates all manifest constraints and influences, and allows 
adequate margin to accommodate a normalized amount of changes. This process entails 
building in launch margin, cargo and logistics margin, and crew timeline margin while 
preserving the technical element needed for safe and reliable operations. United Space 
Alliance is using the Manifest Assessment System to assess the feasibility of proposed 
technical and manifest changes to determine how changes to facility availability, schedule, or 
duration of flight production activities affect the overall manifest schedule. This capability 
enables a more useful way to implement realistic, achievable schedules while successfully 
balancing technical, schedule, and resource risks to maintain safe and reliable operations. 

Policies are also in place to ensure the workforce health at KSC in the face of schedule 
deadlines. The Maximum Work Time Policy, found in KSC Handbook (KHB) 1710.2, section 

3.4 includes daily, weekly, monthly, yearly, and consecutive hours worked limitations. 
Deviations require senior management approval up to the KSC Center Director and 
independent of the Space Shuttle Program. KSC work time safeguards ensure that when 
available resource capacity is approached, the schedule is adjusted to safely accommodate the 
added work. When possible, launches are planned on Wednesdays or Thursdays to minimize 
weekend hours and associated costs; repeated launch attempts are scheduled to reduce crew 
and test team fatigue. Overtime hours and safety hazard data are continually monitored by 
KSC and Space Shuttle Program management for indications of workforce stress. 

3.10.4 RTF TG Assessment 

The CAIB explored a number of root causes for the Columbia accident; one of these was the 
desire to maintain a schedule for achieving U.S. Core Complete during construction of the 
International Space Station. The ISS Program had a long history of cost and schedule 
overruns and had been the subject of numerous Congressional hearings and independent 
commissions. NASA was determined to complete construction with as few additional 
budgetary resources as possible. In this environment, there was a reluctance to expend the 
resources to investigate obvious problems with the Space Shuttle, among them the shedding 
of foam from the External Tank (ET). Damage to a Solid Rocket Booster - caused by foam 
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from the ET - two flights before Columbia , prompted a study into the anomaly, but even this 
was not enough to cause anyone to waiver from the schedule. 

Thus CAIB recommended that NASA “Adopt and maintain a Space Shuttle flight schedule 
that is consistent with available resources...” Recognizing the ongoing nature of this 
recommendation, the Task Group believes it will take vigilance in the future to maintain the 
“appropriate” pressure necessary to maintain a schedule for such a complex system without 
the pressure becoming, for any reason, “undue.” 

Recognizing the difficulty in assessing this recommendation, the Task Group undertook 
several activities in an attempt to evaluate the presence of “undue” schedule pressure and the 
general availability of resources. The Task Group consistently explored the question of 
adequacy of resources in virtually every meeting with NASA personnel - from Headquarters 
staff to the workforce on the floor of the Kennedy Space Center. The answer has always been 
the same: “.. .there are sufficient budgetary resources for return to flight.” 

Recognizing that any assessment is a snapshot, the Task Group also requested data on 
overtime and other work rule exceptions. The RTF TG looked at reports on sick leave, 
employee assistance visits, accidents, and near-accidents (close-calls or “diving catches”), as 
well as reports of problems with the quality of workmanship being performed. Altogether, 
these data, compared with previous intervals prior to launch, showed no unusual patterns 
suggestive of substantial adverse pressure. 

During the middle of 2004, press reports claimed NASA personnel were concerned about 
resources and the possibility of workforce reductions. The RTF TG was not able to confirm 
these reports and notes most were made prior to the finalization of the Fiscal Year 2005 
NASA budget, during a time when exercises were being conducted to assess the impacts of 
various alternative levels of spending. NASA was one of the few federal agencies to receive 
full funding, although funding for aeronautics programs was severely cut to fund space 
initiatives, particularly the Vision for Space Exploration. 

The Task Group also had the opportunity to assess the outcome of NASA’s budget requests 
over the last two years. Fast year (FY05), Congress actually added funds to the request to 
augment retum-to-flight activities, and this year has taken actions to help protect resources for 
NASA in the future. And while NASA has somewhat reduced funding for the Headquarters 
Office of Safety and Mission Assurance, the Task Group has been assured these reductions 
will have no effect on retum-to-flight activities. 

The RTF TG assessment of NASA’s actions was completed at the June 8, 2005, meeting. The 
intent of CAIB Recommendation 6.2-1 has been met. 

3.10.5 RTF TG Observations 

Resource sufficiency is also tied to the scheduled retirement date for the Space Shuttle, and 
any evaluation of whether to keep Space Shuttle in service past 2010 should include a 
reassessment of actions and upgrades not undertaken, and any long term items already deleted 
from work and acquisition cycles, including the Service Fife Extension Program. 

The Task Group also observes that resource constraints will likely pressure future programs, 
such as the Vision for Space Exploration. There will always be pressure for under-funding 
and overly-aggressive scheduling that must be recognized and mitigated by senior leadership. 
Along these lines, NASA must address the size and mixture of its future workforce to 
accomplish its new missions. 

As new NASA space flight programs evolve, the Space Shuttle could well be caught between 
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competing goals (e.g., the 2010 retirement date, Hubble SM4, and the delays in fielding a new 
vehicle). NASA will need to exercise great rigor to ensure that competing budgetary 
requirements do not affect the safety and reliability of Space Shuttle. 


Discovery at the 
beginning of her 
slow trip to Launch 
Complex 39B, as 
seen from inside the 
Vehicle Assembly 
Building. 
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3.11 CAIB Recommendation 6.3-1 - 

Mission Management Team Improvements 

Implement an expanded training program in which the Mission Management Team faces 
potential crew and vehicle safety contingencies beyond launch and ascent. These 
contingencies should involve potential loss of Shuttle or crew, contain numerous uncertainties 
and unknowns, and require the Mission Management Team to assemble and interact with 
support organizations across NASA/Contractor lines and in various locations. 

3.11.1 RTF TG Interpretation 

Mission Management Team (MMT) activities during the flight of Columbia have been widely 
criticized. Many of the additional capabilities embedded in other recommendations from the 
Columbia Accident Investigation Board (CAIB), such as imagery from various sources, are 
intended to support MMT activities for the next and subsequent flights. In addition to 
enhanced training for participants in the MMT, the Agency will need to exercise these many 
new sources of data and information. 

3.11.2 Background 

The CAIB report was very clear on the importance the accident investigation board placed on 
correcting the organizational behaviors which led to the multiple STS-107 MMT decision 
making failures they identified. Indeed, the CAIB issued 29 findings related to these failures, 
ranging from lapses in MMT leadership and communication, to the passivity of MMT safety 
representatives, to the lack of reliance on solid analysis and engineering data, to the absence 
of effective mechanisms for expressions of concern or dissent. 

According to NSTS 07700, Volume VIII, Appendix D, the MMT is “the program decision¬ 
making body responsible for making programmatic trades and decisions associated with 
launch countdown and in-flight activities ... outside the responsibility or authority of the 
Launch Director or Flight Director.” Throughout STS-107, the CAIB found that the MMT 
(and its processes and procedures) failed to support or result in timely, informed, or effective 
critical decisions. In short, the MMT failed in the performance of its mission. 

During Space Shuttle missions, the Mission Management Team is responsible for oversight of 
the launch and flight operations teams. The countdown and flight operations are conducted to 
rules and procedures approved by program management and are documented in NSTS 07700, 
Volume VIII. The MMT provides guidance to the operations teams during situations that fall 
outside normal operations; the MMT also redefines programmatic priorities when in-flight 
anomalies or off-nominal conditions result in conflicting priorities. 

The MMT responsibilities for a specific Space Shuttle mission begin with a scheduled 
meeting two days prior to a scheduled launch (L-2). The MMT Chair, supported by the entire 
MMT, is responsible for the final GO/NO-GO decision for launch. MMT activities at the 
Kennedy Space Center continue through launch and terminate upon the declaration by the 
Flight Director of “Go for On-Orbit Operations,” approximately 2 hours after launch. At that 
time, MMT activities transfer to the Johnson Space Center. The flight MMT meets daily 
during the subsequent on-orbit, entry, and landing phases, and terminates with crew egress 
from the Orbiter. When the MMT is not in session, all members are on-call and required to 
support emergency meetings convened because of anomalies or changing flight conditions. 

As exhibited during STS-107, the MMT had become somewhat ad hoc and informal in 
nature; there was no clear method to formally present issues in an official forum. Therefore, 
the concerns of individual engineers, the quality of risk assessments, and the pedigree of 
engineering assessments were sometimes poorly understood by senior management. In 
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retrospect, this approach did not adequately sensitize NASA management in general - and the 
MMT, in particular - to actively seek out potential concerns and issues raised by individuals, 
support teams, and working groups. 

3.11.3 NASA Implementation 

As a result of the CAIB findings and recommendations, the Space Shuttle Program began to 
identify necessary changes to the MMT in May 2003. A Space Shuttle Program Requirements 
Change Board on September 11, 2003, reviewed the proposed changes and presented a 
slightly modified set to the Space Flight Leadership Council on November 21, 2003. The 
changes included expanding the MMT membership, better defining member responsibilities, 
making the flight MMT meetings more formal, establishing a time reporting process, and 
establishing a rigorous process for the review and disposition of mission anomalies and 
issues. In addition, NASA contracted with several external evaluators (experts in training and 
critical decision making) and several past flight directors, including Gene Kranz and Glynn 
Lunney, to study the MMT processes and make recommendations to improve 
communications, decision-making, and operational processes. 

NASA established a process for the review and resolution of off-nominal mission events to 
ensure that all such issues are identified to and resolved by the flight MMT. The Space Shuttle 
Systems Engineering and Integration Office will maintain and provide an integrated anomaly 
list at each MMT meeting. All anomalies will be assigned a formal office of primary 
responsibility (OPR) for technical evaluation and will be subject to an independent risk 
assessment by Safety and Mission Assurance (SMA). The MMT has one Space Shuttle 
Program SMA core member and three institutional SMA advisory members from JSC, KSC, 
and MSFC. In addition, the MMT has added the Space Shuttle System Technical Warrant 
Holder as a core member; this person represents the NASA Independent Technical Authority 
as a voting member. The NASA Engineering and Safety Center (NESC) also serves as a 
formal advisor to the MMT. 

The MMT secretary will maintain an action tracking log to ensure all members are adequately 
informed of the status of all anomalies. Closure of actions associated with each anomaly will 
require a formal written request that includes a description of the issue (observation and 
potential consequences), technical analysis details (including databases, employed models, 
and methodologies), recommended actions and associated mission impacts, and flight closure 
rationale, if applicable. These steps are designed to eliminate the possibility of critical 
missteps by the MMT due to incomplete or un-communicated information. NASA has 
documented these changes in a new Mission Evaluation Room console handbook that 
includes MMT reporting requirements, a flight MMT reporting process for on-orbit vehicle 
inspection findings, and MMT meeting support procedures. 

Additional improvements were made to MMT internal processes and procedures, including 
more clearly defining requirements for MMT meeting frequency and the process for 
requesting an emergency MMT meeting. The MMT will hold meetings daily beginning at L-2 
or L-1 day, depending on the scheduled time of launch. The membership and organization of 
the preflight and flight MMT are standardized. In addition, the Space Shuttle Program Deputy 
Manager now chairs both phases of the MMT, preflight and flight. 

The MMT member’s responsibilities have been clearly defined, and MMT membership and 
training status for each mission is established by each participating organization in writing at 
the Flight Readiness Review (FRR). Each MMT member also has clearly defined processes 
for MMT support and problem reporting. 

Procedures for flight MMT meetings are standardized through the use of predefined templates 
for agenda formats, presentations, action item assignments, and readiness polls. This ensures 
that the communication and resolution of issues are performed in a consistent, rigorous 
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manner. Existing Space Shuttle Program meeting support infrastructure and a collaboration 
tool are used to ensure that critical data are distributed before scheduled meetings and that 
MMT meeting minutes are quickly distributed following each meeting. In addition, NASA 
established formal processes for the review of findings from ascent and on-orbit imagery 
analyses, post-launch hardware inspections, ascent reconstruction, and all other flight data 
reviews to ensure timely, effective reviews of key data by the MMT. 


Using recognized techniques for improving communications for critical decision making, 
NASA refurbished the Mission Management Team’s working space to provide increased 
seating and improved communications. 

Other enhancements include a video¬ 
teleconferencing capability, a multi-user 
collaboration tool, and a larger room to 
allow more subject matter experts and 
MMT members. A large C-shaped table 
now seats all members of the MMT and 
encourages open communication by 
eliminating a hierarchical seating 
arrangement. The MMT Command 
Center has been operational since the 
November 2004 MMT simulation to 
give the team time to adapt and learn 
how to use all of the new tools. 



The MMT 
conference room 
was refurbished with 
the addition of a 
large C-shaped table 
and multimedia 
capabilities to 
better facilitate 
communications 
between members. 


3.11.3.1 Training 


All MMT members, except those serving exclusively in an advisory capacity and the 
Department of Defense Mission Support representative, are required to complete a minimum 
set of training requirements to attain initial qualification prior to performing MMT 
responsibilities. MMT members must also participate in an ongoing training program to 
maintain qualification status, which is renewed annually. Training records are maintained to 
ensure compliance with the new requirements. 

In addition, to ensure adequate backup personnel are available, at least two people will be 
trained to fill each MMT core position prior to return to flight. This will protect the integrity 
of the integrated MMT process against individuals’ inability to perform their role for any 
reason. Verification of each flight specific team will be presented at the appropriate FRR. 

The Space Shuttle Program published a formal MMT training plan (NSTS 07700, Volume II, 
Program Structure and Responsibilities, Book 2, Space Shuttle Program Directive 150) that 
defines the generic training requirements for MMT certification. This plan is comprised of 
three basic types of training: courses and workshops, MMT simulations, and self-instruction. 
Courses, workshops, and self-instruction materials were selected to strengthen individual 
expertise in human factors, critical decision making, and risk management of high-reliability 
systems. MMT training activities are well under way with several courses/workshops held at 
various NASA centers and 13 simulations completed, including an end-to-end contingency 
simulation and a simulation to address MMT actions related to Contingency Shuttle Crew 
Support (see Section 3.16, SSP-3). These simulations brought together the flight crew, flight 
control team, launch control team, engineering staff, outside agencies, and ISS and Space 
Shuttle MMT members to improve communication and teach better problem-recognition and 
decision-making skills. 

Quality assurance processes have been established to help monitor that MMT training 
requirements are met, sustained, and improved over time. Numerous channels have been 
opened to allow the real-time expression of concerns or dissent. The support teams, including 
contractors, have revised their processes to better serve the MMT and have trained to these 
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new processes. Formal training objectives, evaluation processes, metrics, and a closed-loop 
lessons-leamed system are now a part of MMT training. Independent external evaluators will 
continue to challenge the integrity of MMT training. The International Space Station and 
Space Shuttle MMTs have cross-trained and are improving the standardization of processes 
and communications. The development of NSTS 60540, STS-114 Operations Integration 
Plan for Thermal Protection System Assessment has greatly improved the real-time decision¬ 
making process concerning potential Orbiter Thermal Protection System damage (see Section 
2.2 of this report for a further discussion of the OIP). 

Risk management is now a major consideration at each MMT meeting. Each identified hazard 
is required to have a clear risk assessment performed and presented to the MMT so the 
appropriate risk-versus-risk tradeoffs can be discussed and decided upon. Supporting 
analyses, assumptions, issues, and ramifications are a part of this discussion. 

3.11.4 RTF TG Assessment 

Because of the central role played by the MMT during the last flight of Columbia , the Task 
Group conducted a great deal of fact-finding regarding this recommendation. Members 
attended the first “live” simulation on December 3-5, 2003, and additional sims on February 
11, 2004, April 2, 2004, November 16-19, 2004, February 28 through March 7, 2005, and 
May 4, 2005. A variety of meetings, classroom training, assessed evaluations, and training 
exercises were also attended by the Task Group members and staff. NASA submitted a 
closure package in November 2004, but after review the Task Group requested additional data 
and simulations, especially one that exercised consideration of Contingency Shuttle Crew 
Support. A revised closure package was submitted to the Task Group on March 7, 2005. The 
Task Group again requested to witness a simulation that demonstrated the complex risk- 
versus-risk trades involved with the possibility of invoking the CSCS capability; this sim was 
finally held on May 4, 2005. 

NASA has developed a new training plan for the MMT. With the passage of time, the Task 
Group has been able to witness the implementation of most aspects of the plan. There have 
also been numerous simulations conducted to date including more than ten involving live, 
face-to-face exercises of various parts of the next mission. 

Some of the training protocols were initially developed without clear objectives and 
techniques to assess the quality of training. Similarly, the first simulations lacked clear 
objectives and evaluation criteria. Further, lessons learned from prior simulations were not 
incorporated in subsequent exercises. With a maturing training program, many of the earlier 
deficiencies have been corrected and the MMT Training Plan has been updated to reflect 
formal evaluation requirements. However, not all aspects of the enhanced role of the MMT 
have been exercised completely, such as the potential use of the CSCS option and a launch- 
on-need rescue mission (STS-300) and the incorporation of all new sources of data and 
imagery. The MMT held a special simulation (sim #13) that included consideration of 
invoking the CSCS capability; most Task Group members in attendance were satisfied with 
the results. 

The various delays in launching STS-114 have allowed the MMT to further refine its 
procedures and have resulted in continual improvement. The Mission Management Team has 
made notable progress in addressing the accident board’s concerns, and NASA has 
demonstrated a commitment to continual MMT improvement. 

The RTF TG assessment of NASA’s actions was completed at the June 8, 2005, meeting. The 
intent of CAIB Recommendation 6.3-1 has been met. 
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3.11.5 RTF TG Observations 

The Task Group recognizes that the notable MMT improvements made to-date are a journey, 
not an end, and MMT processes and member training need to continue to grow and mature 
through the remaining missions of the Space Shuttle Program. In addition, NASA needs to 
ensure that the MMT and its support teams understand and have confidence in their ability to 
incorporate the latest analytical and engineering information available to them, to include the 
totally integrated risk assessment of the Space Shuttle system and its knowns, unknowns, 
limitations, uncertainties, and assumptions. Specific observations of areas that need continual 
improvement include: 

• NASA needs to continually grow and improve a systematic MMT training 
evaluation system which ensures that MMT training focuses on value, required 
knowledge, and the “science of learning.” The course content, simulation design 
and delivery, and self-instruction requirements must be continuously assessed 
and quality assurance plans rigorously applied. NASA should also consider 
formal MMT training on new and emerging capabilities, such as inspection, 
imagery, and CSCS. 

• Just as the MMT needs to adjust and improve with each “learning experience” 
(training or live), all of the documents supporting the MMT need to be 
continually updated and refined based on experience, need, and the evolving 
MMT decision-making capabilities. 

• The MMT needs to continue to improve and mature their integrated risk-versus- 
risk identification, assessment, decision making, and trades capabilities based on 
the latest available information and systems integration capabilities to guide 
them in their time-sensitive critical decisions. This includes the certainties and 
uncertainties that exist in the various analytical tools and models used by the 
MMT. Existing linear (i.e., non-integrated) decision making frameworks and the 
existing meeting agenda format need to be continually assessed and revised to 
meet the MMT’s needs. 

• In terms of the new, more rigorous training requirements, NASA also should 
recognize the opportunity to capitalize on the broader test and validation 
potentials of MMT simulations for other technical and operational capabilities 
beyond just the training of MMT members. 

• Post -Columbia, NASA senior leadership have new responsibilities in terms of 
MMT decision making and, during future MMT simulations need to ensure that 
MMT processes fully support their new Headquarters roles for time critical 
decisions and risk-versus-risk trades and periodically exercise them. Specific 
areas where NASA Headquarters senior leaders have new responsibilities 
include Safety and Mission Assurance, the Independent Technical Authority, 
and the potential decision to declare the need to implement the Contingency 
Shuttle Crew Support capability and its resulting launch-on-need rescue mission. 

• As a senior critical decision-making team, the MMT will continue to have 
unique insight into areas where there are critical information gaps, seams, 
unknowns, and uncertainties. The MMT can further serve NASA and the 
program by helping to point out these areas and prioritize them for focused 
closure. 

• Finally, the Task Group observes that NASA should consider formalizing 
periodic, independent oversight of the MMT to help sustain it as a “continuously 
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learning” entity for the remainder of the Space Shuttle Program. On at least an 
annual basis, an external entity should observe, evaluate (audit), and challenge 
the MMT’s ability to continuously improve, as well as evaluate MMT member 
certifications and training. 

While the Agency’s implementation of this recommendation has been serious and 
comprehensive, it will, by its very nature, remain a “work in progress” for the remaining 
missions of the Space Shuttle Program. Many lessons have been learned from the Columbia 
accident over the past 29 months, but with each mission many other lessons will also be 
learned. As stated previously, the fulfillment of R6.3-1 is a journey, not an end. 


The Vehicle 
Assembly Building 
(VAB) at the 
Kennedy Space 
Center is one of the 
largest enclosed 
spaces in the world. 

The building was 
originally constructed 
as part of the Apollo 
moon program, and 
is currently used to 
stack the Space 
Shuttle vehicle. 
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3.12 CAIB Recommendation 6.3-2 - 

National Imagery and Mapping Agency Memorandum of Agreement 

Modify the Memorandum of Agreement with the National Imagery and Mapping Agency to 
make the imaging of each Shuttle flight while on orbit a standard requirement. 

3.12.1 RTF TG Interpretation 

There was considerable public discussion of the decision during the flight of Columbia to 
forego requesting the assistance of other federal agencies in assessing the condition of the 
Orbiter. The Columbia Accident Investigation Board (CAIB) wanted the Space Shuttle 
Program to have the procedures in place to get all possible data to investigate a potential 
problem. This included having the proper personnel maintain the appropriate security 
clearances to access data from National assets. 

3.12.2 Background 

The National Imagery and Mapping Agency (NIMA) was created in 1996 by combining the 
mapping and imagery analysis efforts of the Central Intelligence Agency (CIA) and 
Department of Defense (DoD). On November 24, 2003, NIMA changed their name to 
the National Geospatial-Intelligence Agency (NGA) as dictated by the 2003 Defense 
Authorization Bill. 

National assets were available that potentially could 
have revealed the damage to Columbia while on orbit, 
but these assets were not used during the flight. NASA 
has previously used National assets to support the 
Space Shuttle Program, but the process and procedures 
to do so were overly complex and obscure. 

The CAIB found that the relationships between NASA 
and other Government agencies that could provide the 
assessment capabilities needed to be formalized and 
strengthened. Additionally, they recommended that 
such assessments should become a part of the standard 
mission requirements for each Space Shuttle flight, that all decision-makers within the Space 
Shuttle Program be made aware of the available capabilities, and that a small set of personnel 
maintain the appropriate security clearances and briefings. 

3.12.3 NASA Implementation 

The Memorandum of Agreement (Mo A) with the National Imagery and Mapping Agency was 
modified in July 2003 as recommended by the CAIB. NASA has since worked with the full 
range of supporting agencies to develop an Interface Operations Agreement that maximized 
the use of available National assets to assist in on-orbit assessments. The NASA Standard 
Operating Procedures for requesting support from appropriate federal agencies were 
completed in December 2003 and have been exercised successfully. The capabilities have 
been, and will continue to be, demonstrated during MMT simulations. 

In order to fully comply with the CAIB recommendation, NASA has identified the positions 
that require access to classified data and will ensure that all NASA personnel involved in 
human space flight are familiar with the general capabilities available for on-orbit vehicle 
assessments and the procedures to request and process such assessments. NASA has also put 
in place secure data transmission systems and procedures for the dissemination of classified 
information to the NASA Space Operations Mission Directorate field centers. 
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Final implementation details have been worked out in a lower level memorandum of 
understanding. Since this action may involve receipt and handling of classified information, 
the appropriate security safeguards will be observed during its implementation. 

Although these actions address the recommendation found in CAIB R6.3-2, NASA has taken 
additional appropriate actions with other federal agencies to maximize use of National assets 
for all flight segments. NASA has teamed with the Department of Defense and the 
intelligence community to develop new agreements and operating procedures to obtain 
support from the partnering agencies. 

3.12.4 RTF TG Assessment 

Fact-finding meetings were attended by the Task Group on December 8, 2003, and February 
18-19, 2004, where the Memorandum of Agreement with the NGA was discussed. The next 
lower-level Interface Operating Agreement that details the methods for NASA to obtain 
information, and how that classified information would be handled within NASA were also 
discussed. The detailed plans and agreements themselves are classified due to the nature of 
National assets they discuss. 

The Task Group’s initial evaluation of NASA’s actions was completed at the April 16, 2004, 
teleconference plenary where the assessment was conditionally closed. The conditions 
required that NASA present the results of an integrated simulation that exercised the NGA 
Mo A for assessment by the RTF TG. After receiving additional information from NASA, the 
assessment was closed at the December 16, 2004, plenary meeting. The intent of CAIB 
Recommendation 6.3-2 has been met. 

3.12.5 RTF TG Observations 

The Task Group believes that NASA should periodically review the Memorandum of 
Agreement with the National Geospatial-Intelligence Agency, assess the capabilities of the 
NGA and other agencies, and ensure that the appropriate security clearances are maintained 
within NASA to exploit these capabilities as necessary. In addition, this capability should also 
be periodically exercised during MMT simulations. 


Discovery in the 
Vehicle Assembly 
Building transfer 
aisle, ready to be 
lifted to the vertical 
position in 
preparation for 
mating with the 
External Tank and 
Solid Rocket 
Boosters. 
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3.13 CAIB Recommendation 6.4-1 - 

Thermal Protection System Inspection and Repair 

For missions to the International Space Station, develop a practicable capability to inspect 
and effect emergency repairs to the widest possible range of damage to the Thermal 
Protection System, including both tile and Reinforced Carbon-Carbon, taking advantage of 
the additional capabilities available when near to or docked at the International Space 
Station. 

For non-Station missions, develop a comprehensive autonomous (independent of Station) 
inspection and repair capability to cover the widest possible range of damage scenarios. 

Accomplish an on-orbit Thermal Protection System inspection, using appropriate assets and 
capabilities, early in all missions. 

The ultimate objective should be a fully autonomous capability for all missions to address the 
possibility that an International Space Station mission fails to achieve the correct orbit, fails 
to dock successfully, or is damaged during or after undocking. 

3.13.1 RTF TG Interpretation 

Based on a majority opinion of the members, the Task Group revised its interpretation of this 
CAIB recommendation at the June 27, 2005 meeting. The interpretation that the final 
assessment was based on follows: 

CAIB Recommendation 6.4-1 consists of four separate provisions. Although the 
entire recommendation is labeled Return to Flight, the second and fourth provisions 
do not apply to STS-114. These provisions are not being considered by NASA or the 
Task Group. If a non-ISS mission, such as Hubble Space Telescope (HST) Service 
Mission 4, is added to the flight manifest, the ASAP should review this 
recommendation. 

NASA must define any damage to tile and RCC that poses an unacceptable hazard to 
the Orbiter and crew during entry, and be able to detect the location and extent of 
such damage. Assessment of NASA’s on-orbit TPS inspection capability is covered 
in Recommendation 3.4-3 

Each of the repair options in the suite of options that constitutes the repair capability 
must be have completed formal design reviews, ground verification testing, 
procedure development and an integrated Design Certification Review such that 
NASA could implement it in an emergency situation with confidence that it would 
behave as expected 

3.13.2 Background 

The Columbia accident clearly demonstrated that the Orbiter Thermal Protection System, 
including the reinforced carbon-carbon (RCC) panels and acreage tiles, was vulnerable to 
impact damage from the existing debris environment. As a result, the Columbia Accident 
Investigation Board (CAIB) issued recommendations to eliminate debris (R3.2-1), determine 
the structural integrity of the RCC (R3.3-1), harden the Orbiter (R3.3-2) against impacts, and 
to develop on-orbit repair capabilities (R6.4-1). 

The concept of a “tile repair kit” is hardly new. Such a kit was originally intended to be flown 
aboard STS-1 and work was undertaken by NASA and its contractors, particularly Martin 
Marietta. However, as the launch of STS-1 approached, the development effort was cancelled 
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due to a variety of technical problems and a renewed confidence in the tiles themselves. At 
the time, the RCC was considered particularly resilient and there was little thought given to a 
repair capability; as later events demonstrated, this assumption was incorrect. 

3.13.3 NASA Implementation 

Note: This section refers to inspection and repair during missions to the ISS. 

NASA has expanded the capabilities to detect debris liberated during ascent, to locate where 
debris may have originated, and to identify impact sites on the Orbiter Thermal Protection 
System for detailed evaluation. Methods to access the Orbiter for possible repair have been 
evaluated and procedures developed and trained. In addition, five repair techniques have been 
selected to be carried on STS-114. 

These capabilities, paired with NASA’s improved insight into the impact and damage 
tolerance of the Orbiter, will allow the Mission Management Team (MMT) to make informed 
decisions about whether any impacts sustained represent a threat to mission success or the 
safety of the crew and the vehicle. They will also help to determine whether any repairs that 
are attempted are successful. 

3.13.3.1 Inspection 

NASA will use a combination of Space Shuttle and International Space Station assets to 
evaluate the Orbiter Thermal Protection System and identify and characterize whether damage 
was sustained during ascent. These inspection assets and methods include the Orbiter Boom 
Sensor System (OBSS), the R-Bar Pitch Maneuver, the Shuttle Remote Manipulator System 
(SRMS), the Space Station Remote Manipulator System (SSRMS), and an experimental wing 
leading edge impact detection system. Each inspection method provides a piece of 
information to improve insight into the conditions of the Orbiter Thermal Protection System. 


A computer¬ 
generated image of 
the OBSS in 
operation while 
attached to the 
Shuttle Remote 
Manipulator System. 

The OBSS is 
capable of inspecting 
all of the RCC on the 
Orbiter, as well as 
the majority of the 
tiles on the 
underside of the 
vehicle. 
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3.13.3.1.1 Orbiter Boom Sensor System 

The OBSS is an imaging system that consists of two sensor packages on the end of a 50-foot- 
long boom structure. The boom is carried on the starboard sill of the Orbiter payload bay 
(which had originally been configured to carry a second remote manipulator system arm if 
needed) and is used in conjunction with the Shuttle Remote Manipulator System (SRMS) 
carried on the port sill. The OBSS carries a laser camera system (LCS) and a laser dynamic 
range imager (LDRI) that downlink data via the Orbiter communications system. The data 
will be processed and analyzed on the ground as part of the Thermal Protection System 
assessment process. The OBSS is the primary system used to inspect the wing leading edge 
and nosecap RCC, and also to obtain detailed depth measurements of damaged areas. In 
addition, the OBSS has the capability to support a crewmember in foot restraints if needed to 
perform inspection or repair during extra-vehicular activities (EVA). 

On flight day 2, prior to docking with the ISS, the crew will use the OBSS to inspect the 
nosecap and the underside and apex of the 22 leading edge RCC panels on each wing. If any 
evidence of a debris strike exists, the OBSS instruments will be used during flight day 4 for 
more detailed inspections of specific areas. 

3.13.3.1.2 ISS Imagery during the R-bar Pitch Maneuver 

The primary method of inspecting the acreage tile on the bottom of the Orbiter consists of 
imagery taken by the ISS crew as the Orbiter approaches for docking. This approach, called 
the R-Bar Pitch Maneuver, has been practiced by Space Shuttle flight crews in the simulator. 
When the Orbiter is 600 feet away from the ISS, it will pause its approach and pitch-over to 
present its underside to the station. The ISS crew will take overlapping high-resolution digital 
still images of the acreage tiles and downlink them to the ground. Areas of concern will be re¬ 
inspected for more detail (such as damage depth) while the Orbiter is docked to the ISS. 

The cameras used during the R-Bar Pitch Maneuver have the capability to detect critical 
damage in all areas of the Orbiter Thermal Protection System tile. Analysis indicates that the 
photos taken with a 400mm lens have an analytical resolution of 3 inches on normal surfaces; 
the 800mm lens provides a 1-inch analytical resolution. 

3.13.3.1.3 Other Imagery Assets 

Other imagery assets include the cameras on SRMS, the SSRMS, and digital camera assets on 
board the Orbiter or the ISS. The SRMS and SSRMS can inspect areas of the Orbiter Thermal 
Protection System within their reach, such as the crew cabin area, forward lower surface, and 
vertical tail, using their closed circuit television camera systems. Other assets include the still 
cameras available to EVA crewmembers in the event an EVA inspection is required to do 
focused inspection of areas that may have suspected damage. These alternate inspection 
methods are not pre-planned, and will be used as a backup for the other inspection methods. 

3.13.3.1.4 Wins: Leading Edge Impact Detection System 

The wing leading edge impact detection system was developed from an existing technology 
that had been previously flown as an experiment in the Orbiter aft fuselage. Initially, NASA 
hoped to include the wing leading edge sensors as a key element to detect damage. However, 
this system has not been flight-tested in this environment, so its actual capability is yet to be 
determined. For STS-114, these sensors will be used primarily to “point” to areas of the wing 
leading edge needing further inspection by the OBSS. 

The wing leading edge impact detection system is composed of accelerometer and 
temperature sensors attached to the wing spar behind the reinforced carbon-carbon panels. 
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These battery-powered sensors transmit data via RF to receivers in the Orbiter. The data are 
collected during ascent and downlinked to the ground via the Orbiter communications system 
once on-orbit to help identify possible debris impact areas on the wing leading edge RCC 
panels. In the event an impact is detected, engineers can determine the location of the 
sensor(s) that measured the impact and, through the TPS assessment process, recommend a 
more focused inspection of the suspect area later in the mission. Due to the limited battery life 
in the current implementation, there is a finite period of time for collection and transfer of 
impact data using this system. In the future, the power source will be changed from batteries 
to the Orbiter’s main electrical systems, allowing the sensor system to provide impact 
detection throughout the mission. 

3.13.3.2 Repair 

Despite extensive efforts to develop TPS materials and techniques, the state-of-the-art in this 
area has yielded little technology to support the concept. As a result, continued effort does not 
hold promise of significant capabilities beyond those in hand. While a vehicle-wide TPS 
repair capability is not a constraint to the return to flight, STS-114 will carry a limited number 
of experimental materials and tools to repair minor tile damage and small- to medium-sized 
RCC damage in an emergency. 


A variety of special 
tools are being 
carried aboard 
STS-114 and future 
flights in case repairs 
to the reinforced 
carbon-carbon 
panels becomes 
necessary. 
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To effect repairs, the EVA crew will use either the SRMS or the SSRMS to gain access to 
locations on the Orbiter; when necessary, they may also use the OBSS. NASA has also devel- 
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oped a combined SRMS and SSRMS “flip around” operation, called the Orbiter Repair 
Maneuver (ORM), to allow TPS repairs while the Orbiter is docked to the ISS. The ORM 
involves turning the Orbiter into a belly-up position that allows the SSRMS to position an 
EVA crewmember to reach any TPS surface needing repair. The procedure is feasible until 
later flights when the ISS grapple fixture required to support this maneuver will be blocked, 
and new TPS repair access techniques will need to be developed. 

3.13.3.2.1 RCC Repair 

NASA has evaluated RCC repair concepts with participation from six NASA Centers, 11 
contractors, and the United States Air Force Research Laboratory. The main challenges to 
repairing RCC are maintaining a bond to the RCC coating during entry heating and meeting 
stringent aerodynamic requirements for repair patches and fills. NASA is investigating two 
complementary repair concepts - plug and crack - that together could, in the future, allow the 
emergency repair of limited RCC damage. Both concepts have limitations in terms of damage 
characteristics, damage location, and amount of testing and analysis completed to-date. 

NOAX 


Non-Oxide Adhesive experimental sealant (NOAX) is a pre-ceramic polymer sealant 
intended to repair cracks up to 0.065-inch-wide by 9-inches-long, and small areas (1-inch at 
the outer mold line and 2-inches at the inner mold line) of coating loss on any Orbiter RCC 
panel. Curing NOAX requires a heater, adding significant complication to its use on-orbit; 
however, uncured NOAX has recently passed arc-jet tests, leading to a decision not to use the 
heater to cure the material. NOAX has been shown to 
be successful in repairing cracks in ground tests but 
process controls will be more challenging in the EVA 
environment. At this time, there is uncertainty 
concerning the microgravity behavior of the material, 
and there is limited ground testing on real RCC 
substrate with realistic damage. This technology will be 
tested during an EVA development test objective 
(DTO) on STS-114. 

Plus Repair 

The plug repair is intended for small to medium-size 
holes in some areas of the wing leading edge RCC. A 
flexible carbon-silicon carbide (C-SiC) cover plate is 
held in place with a SiC-coated TZM toggle bolt and 
sealed around the edges with NOAX. Each plug cover 
plate might repair up to a 4-inch-diameter hole (major 
dimension) with a 1-inch surrounding spalled area. If 
the existing hole is less than 1-inch diameter, a drill 
will be used to enlarge the hole in order to insert the 
toggle bolt. A dozen different cover plates with various 
curvatures are available and provide coverage for 62- 
percent of the wing leading edge RCC areas. Although 
arc-jet testing indicates that the material can withstand 
entry, there are concerns about the bolt fracturing if the 
SiC coating is scratched. There are also concerns about 
drilling through RCC to insert the plug, especially if 
there is not a preexisting hole. A middeck DTO on the 
mechanical function of this repair capability, excluding 
drilling, will be performed on STS-114. 



The plug repair starts 
with either a 
pre-existing hole in 
an RCC panel, or 
with the astronaut 
drilling a hole. A 
toggle bolt is 
inserted through the 
hole to hold the 
carbon-silicone 
carbide cover in 
place. NOAX is used 
around the edge as 
a sealant. 
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3.13.3.2.2 Tile Repair 

A limited tile repair capability will be ready for on-orbit testing on STS-114. On this flight, 
NASA plans to demonstrate the emittance wash technique during an EVA, fly two Cure-In- 
Place Ablator (CIPA) applicators (that will not be demonstrated) that could repair tile 
damage, and fly a mechanical overlay (also not demonstrated) that could potentially repair 
larger areas of damage in the acreage tiles. 


A hand-held 
extrusion gun is 
used to apply the 
emmitance wash. 
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The CIPA hardware 
is much more 
involved, with most 
components 
contained on a 
backpack that fits 
over the EVA suit. 



Emittance Wash 


Emittance wash, a silicon carbide (SiC) 
material mixed with a carrier, is expected to be 
effective for shallow tile damage on any black 
tile surface. While initially developed as a 
surface preparation for the CIPA technique, 
NASA determined the material has a stand¬ 
alone repair potential. Emittance wash 
partially restores the emissivity of damaged 
tile surface to increase heat rejection through 
radiation, and is used to prevent small gouges 
in the tile from becoming deeper holes. The 
material is applied using an extrusion gun. 
Arc-jet tests are continuing to gather data on 
the thermal performance of a repair using this 
technique; however, thermal performance 
testing will be limited before STS-114. 

Cure-in-Place Ablator (CIPA) 

Two CIPA applicators will be carried aboard 
STS-114, potentially allowing repair of tile 
damage sites anywhere on the Orbiter except a 
small number of LI-2200 tiles. The CIPA 
material, called STA-54, is a two-part room 
temperature material that is applied with a 
pneumatic dispenser gun that mixes the two 
parts within the dispenser. Ancillary tools 
include emittance wash to prime the surface, 
gel and foam brushes to clean the surface, 
stamps to shape the material, a contour gage to 
measure the material surface relative to the 
outer mold line, and a durometer to test 
hardness. The CIPA “goo” is intended for use 
in deeper tile damage in areas up to 10 by 20 
inches. If a CIPA repair is attempted, a second 
EVA will be required to inspect the repair and 
test the hardness. This information along with 
photographs of a dissected “test bead” created 
at the same time as the repair are required to 
assess the integrity of the repair for entry. The 
quality of the repair appears to be highly 
operator dependent. 

There have been multiple technical difficulties 
in the development of the CIPA materials and 
application tools. Most significant of these is 
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recurrent bubbling in the STA-54. NASA has been unable to determine the root cause of the 
bubbling, or to adequately and consistently characterize its severity. Additionally, there 
remain several areas of uncertainty about the material properties of STS-54, including its 
ability to cure during the thermal cycling of Earth orbit and its adhesion to tile during entry, 
since tile and STA-54 have different thermal expansion coefficients. 

Though somewhat unpredictable, bubbling of the material has been shown in arc-jet testing to 
be less important in the ability to protect the Orbiter than originally thought, but testing in the 
actual on-orbit environment is necessary to confirm this finding. Analytical models for CIPA 
repair assessment are uncorrelated with test data, and if the material is used as an emergency 
repair on STS-114, formal validation testing to material performance requirements will be 
limited to real time arc-jets test. 

Another issue concerns the level of toxicity of one of the STA-54 components prior to mixing 
and dispensing. At this time the program is pursuing a triple level of containment - a common 
toxicity mitigation technique - for STA-54 stowage and is assessing the crew risk during 
EVA use for the STS-121 development test objective or if needed for tile repair. 

Tile Overlay 


The mechanical overlay repair is performed by 
filling the damaged tile cavity with a Saffil 
batting insulation, then placing a thin C-SiC 
cover plate and high-temperature gasket seal 
over the damaged tile area. SiC-coated ceramic 
augers (screws) with accompanying SiC-coated 
ceramic washers are screwed into undamaged 
tiles to attach the overlay. The 12-inch by 
25-inch overlay is capable of covering a 10-inch 
by 20-inch damage area. While this technology 
is being carried as a contingency on STS-114, its 
testing is very immature at this time. However, 
development testing is on a fast track and NASA 
believes this option appears to be promising. 


3.13.3.3 TPS Damage Assessment 

The Space Shuttle Program has developed a substantial knowledge-base of the vulnerabilities 
of both tile and RCC, and the level of damage that testing to date indicates could be sustained 
without unacceptable risk during entry. This knowledge is essential for decision-making in the 
event that on-orbit inspection reveals damage to the TPS. Critical damage size has been 
defined and is highly location dependent. NASA has incorporated the experimental data 
gleaned over the last year to create a “critical damage map” that reflects the best 
understanding to date. For RCC, critical damage in the most vulnerable areas is a 0.020-inch¬ 
wide crack or a 0.08-inch (major dimension) coating loss. A 1-inch (major dimension) gouge 
around the main landing gear door seals or ET umbilical door seals, or a 3-inch gouge in 
acreage tile represents critical tile damage. If damage exceeding these dimensions is detected, 
reducing Orbiter weight, altering the entry profile, reducing landing sink rate, and other 
options will be considered, along with or in lieu of repair, to achieve an acceptable condition 
for entry. The decision to land an Orbiter with an untested repair will require a difficult 
decision based on models, experimental runs in the arc-jet, and flight history of the thermal 
environment during the entry. The OIP companion document, NSTS 60540-ANX1 Orbiter 
Damage Assessment Process Annex , describes the teams, tools, and processes that will be 
used to transform data from the TPS assessment teams into information that can be used about 
the condition of the TPS at multiple milestones during flight by program leadership to make a 
timely entry readiness, repair, or Contingency Shuttle Crew Support determination. 
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The tile overlay repair 
is a metallic sheet that 
is screwed in place 
over the damaged tiles 
after the cavity is filled 
with Saffil batting 
insulation. 
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3.13.4 RTF TG Assessment 

The Orbiter Thermal Protection System was never intended to be repaired on-orbit. Various 
repair capabilities were explored early during Space Shuttle development and again more 
recently, but it is highly unlikely that a comprehensive repair capability for all possible 
damage will become available for the remaining flights of the Space Shuttle Program. Tile 
and RCC repair have proven to be far more challenging than either the CAIB or NASA 
understood two years ago. Enormous effort has been expended in search of effective and 
operationally feasible repair capabilities, and far more is known today than before about the 
capabilities and vulnerabilities of the Orbiter Thermal Protection System. Nevertheless, the 
program is far from having a certifiable capability. Several innovative repair solutions for a 
limited range of potential damage are aggressively being pursued. Five such limited repair 
options will be carried on STS-114; however, much more testing and evaluation remain to be 
done. The options proposed by NASA have not yet achieved a level of maturity that the Task 
Group considers necessary to be defined as a capability and thus the intent of this 
recommendation has not been met. 

3.13.4.1 Inspection 

The two primary methods to be used on-orbit for critical inspection of Orbiter Thermal 
Protection System, the OBSS sensor suite and R-Bar Pitch Maneuver have been assessed as 
part the Task Group’s evaluation of CAIB Recommendation 3.4-3, High-Resolution Imagery 
of Orbiter. That recommendation was closed on June 8, 2005 (see Section 3.6 of this report). 
Data from the wing leading edge impact detection system will be used as corroborating 
evidence with imagery data to provide focus for on-orbit inspection. The limited data that will 
be available due to short battery life, together with the experimental nature of this system, 
mandate that no critical decisions be based on the data from this system. 

The Task Group supports use of numerous other sources of ground and airborne imagery 
during launch and ascent to provide views of the External Tanks and Orbiter which serve as 
pointers for focused inspection of the Orbiter by the OBSS. All these capabilities together 
should assure a comprehensive and successful inspection. 

3.13.4.2 Repair Technologies 

Although NASA has determined, and accepted the risk, that the repair capability called for in 
CAIB Recommendation 6.4-1 is not a constraint to launch of STS-114, the Space Shuttle 
Program intends to provide the STS-114 crew with the best available options. An enormous 
amount of work on both tile and RCC repair has resulted in five experimental repair 
techniques. None of these techniques will be certified for STS-114; some may never be 
certified because they are too operator dependent. As NASA stated in the May 2005 version 
of the Integrated Risk Acceptance Approach for Return to Flight - “Until a verifiable, reliable 
Thermal Protection System repair technique for tile and reinforced carbon-carbon components 
is in hand, we will have limited, best effort capabilities to apply when needed.” 

While it is prudent to manifest repair materials and hardware on STS-114 to be used only if 
the Orbiter cannot otherwise make a safe entry, extreme caution must be exercised when use 
of these materials and hardware might further exacerbate the risk to Orbiter and crew beyond 
the risk due to the initial Thermal Protection System damage. In particular, the RCC plug and 
tile overlay repairs require additional holes to be bored into the Thermal Protection System, 
and CIPA and NO AX can each create an additional hazard if the material expands beyond the 
Orbiter outer mold line. Each option carries its own risks. For STS-114, should a damage 
situation require use of any repair technique, the Mission Management Team and NASA 
leadership will confront extremely complex and difficult risk-versus-risk trades given the 
unknowns and uncertainties within and between inspection, repair, and rescue options. 
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3.13.4.3 TPS Damage Assessment 

The Task Group believes that it is just as important to be able to decide when not to repair as 
it is when to attempt a repair, especially when the repair capabilities are unproven. The 
“critical damage maps,” although certified for preflight, continue to evolve to reduce the 
likelihood of making unnecessary repairs. The NASA Engineering Safety Center (NESC) 
peer review of critical tile damage models is an important milestone to be achieved prior to 
STS-114; a preliminary draft was available to the Task Group during this assessment. The 
addition of the peer review provides added confidence in the accuracy of these models. 

The Mission Operations Directorate has defined several alternate scenarios to minimize entry 
heating that will be available should they be required. A number of procedures in various 
stages of maturity can be uplinked so that the crew can make these adjustments. 

Because they will be collecting significant volumes of data on the condition of the TPS, much 
of which will be new to the ground operations team, the Task Group fully supports the 
development of NSTS 6054, STS-114 Operations Integration Plan for Thermal Protection 
System Assessment (the OIP) and it associated Damage Assessment Annex to govern the use 
of all these data in the decision-making process on the health of the Orbiter Thermal 
Protection System and the potential need to repair damage, execute other operational risk 
reduction strategies, or fly home with the expectation that the damage is not large enough to 
be considered critical. See Section 2.2 of this report for a further discussion of the OIP. 

3.13.4.4 Conclusion 

In the May 2005 Integrated Risk Assessment Approach for Return to Flight, NASA 
acknowledges that External Tank debris allowables currently do not protect against 
catastrophic damage to the Orbiter Thermal Protection System. Therefore the goal of 
demonstrating that the Orbiter Thermal Protection System can withstand impact from any 
debris which may be released from the External Tank or other flight elements has not been 
met. Nor can the repair options manifested on STS-114, even if they were certified, repair the 
range of damage that could occur. There is a gap between possible debris liberation and the 
ability of Orbiter Thermal protection System to withstand impact and to repair damage. 

The Task Group has reached the conclusion that the five experimental repair options 
manifested on STS-114 show promise for future flights, but are contingency measures rather 
than practicable repair capabilities at this time. Even though all Orbiter Thermal Protection 
System repair techniques being considered are only for emergency use and cover a limited 
range of potential damage, they can and should go through a rigorous design and certification 
process; to date, none of the tile or RCC repair techniques have gone through this process. 
Therefore, the Task Group does not consider tile and RCC repair techniques sufficiently 
mature to be a practicable repair capability for STS-114. 

As assessed in Section 3.6 (R3.4-3), the inspection techniques planned for STS-114 provide 
high resolution capability and significantly enhance the ability to view possible damage. 
Resources available via National assets (R6.3-2) add to this capability. Therefore, NASA has 
satisfied the inspection portion of this recommendation. 

The RTF TG assessment of NASA’s actions was completed at the June 27, 2005, meeting. 
Despite extensive efforts on the part of the Tile Repair Project and RCC Repair Project to 
develop a practicable Thermal Protection System repair capability, the majority of the Task 
Group believes that the intent of CAIB Recommendation 6.4-1 has not been met. 
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3.13.5 RTF TG Observation 

The RTF TG believes that the repair portion of R6.4-1 presented an extreme technical 
challenge to NASA given the physical characteristics of the Orbiter Thermal Protection 
System. Repairs to TPS damage of the magnitude suffered by Columbia are not considered 
feasible with current technology; however, modifications to the External Tank should 
preclude that type of damage from occurring in the future. 

3.13.6 RTF TG Minority Opinion on CAIB Recommendation 6.4-1 

Much of the discussion among Task Group members has centered on the definition of the 
words “practicable capability.” While Task Group members agree that a practicable capability 
must be “feasible, able to be accomplished,” we cannot agree on the level to which a task 
must be developed before it becomes a “capability.” The minority opinion of the Task Group 
is that a repair technique is a capability if it can actually be performed on orbit and has been 
shown to be able to withstand the heat of entry, which is its intended purpose. 

There has been further discussion around the accident board’s intent when they used the 
words “widest possible range of damage.” Multiple conversations with several members of 
the CAIB, including those most closely associated with the writing of this recommendation 
indicate a clear intent of those words to be “to the widest possible damage that NASA can 
accomplish.” Thus, the fact that NASA does not yet have coverage for 100 percent of the 
Orbiter Thermal Protection System does not preclude compliance with the intent of the 
recommendation. 


While much more testing is necessary to increase the confidence in the repairs and to certify 
them, the repair capabilities are a far cry from the notion outlined for the CAIB that amounted 
to stuffing tools and water-filled baggies into the wing leading edge while dangling from a 
ladder hanging from the payload bay doors (CAIB, Vol. I, p. 173). The use of the crew in the 
development of the operations associated with the repair techniques, coupled with multiple 
training sessions using the standard environments to prepare for EVA operations, have 
resulted in repair techniques that can be put into practice should the need arise. MMT and 
component simulations have shown a willingness of the community to attempt a repair should 
one be deemed necessary, and upon successful completion of that repair, evaluated using set 
criteria, a willingness to bring the Orbiter and crew home rather than commit to a CSCS and 
attempt to launch a second vehicle. 

The minority opinion of the RTF TG is that this is what the CAIB intended when writing 
Recommendation 6.4-1. Therefore, it is the minority opinion of the Task Group that the intent 
of CAIB Recommendation 6.4-1 has been met. 


Discovery, with Earth 
as a backdrop, 
performs the R-bar 
Pitch Maneuver as 
she approaches the 
International Space 
Station. The crew of 
the ISS takes 
high-resolution 
photographs of the 
Orbiter during this 
maneuver to allow 
ground-based 
analysts to 
determine if there is 
any damage to the 
Orbiter Thermal 
Protection System. 
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3.14 CAIB Recommendation 9.1-1 - 

Detailed Plan for Organizational Change 

Prepare a detailed plan for defining, establishing, transitioning, and implementing an 
independent Technical Engineering Authority, independent safety program, and a 
reorganized Space Shuttle Integration Office as described in R7.5-1, R7.5-2, and R7.5-3. In 
addition, NASA should submit annual reports to Congress, as part of the budget review 
process, on its implementation activities. 

R7.5-1 Establish an independent Technical Engineering Authority that is 
responsible for technical requirements and all waivers to them, and will 
build a disciplined, systematic approach to identifying, analyzing, and 
controlling hazards throughout the life cycle of the Shuttle System. The 
independent technical authority does the following as a minimum: 

• Develop and maintain technical standards for all Space Shuttle 
Program projects and elements 

• Be the sole waiver-granting authority for all technical standards 

• Conduct trend and risk analysis at the sub-system, system, and 
enterprise levels 

• Own the failure mode, effects analysis and hazard reporting 
systems 

• Conduct integrated hazard analysis 

• Decide what is and is not an anomalous event 

• Independently verify launch readiness 

• Approves the provisions of the recertification program called for 
in Recommendation R9.2-1 

The Technical Engineering Authority should be funded directly from NASA 
Headquarters and should have no connection to or responsibility for 
schedule or program cost. 

R7.5-2 NASA Headquarters Office of Safety and Mission Assurance should have 
direct line authority over the entire Space Shuttle Program safety 
organization and should be independently resourced. 

R7.5-3 Reorganize the Space Shuttle Integration Office to make it capable of 
integrating all elements of the Space Shuttle Program, including the 
Or biter. 

3.14.1 RTF TG Interpretation 

The Columbia Accident Investigation Board (CAIB) expected NASA to return to flight 
relatively quickly, and did not want to restrict this activity by requiring major organizational 
changes. Instead, the CAIB wrote a separate recommendation that NASA produce a detailed 
plan on how the Agency would implement organizational changes embodied in three other 
recommendations (R7.5-1, Independent Technical Authority; R7.5-2, Safety and Mission 
Assurance; and R7.5-3, Systems Engineering and Integration). 
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However, preparations for the first return-to-flight mission took longer than initially expected, 
and NASA proceeded to implement the three specific organizational recommendations of the 
CAIB; the Task Group elected to evaluate the actual changes, although the final assessment 
was based only on the required plan. 

The CAIB used the term “culture” throughout its report, although there was not a specific 
recommendation (RTF or otherwise) to change NASA culture. Nonetheless, numerous CAIB 
findings and observations strongly emphasize leadership, managerial, training, and 
organizational issues that require immediate and serious attention. Within the parameters of 
the RTF TG charter, the Task Group did not specifically address these CAIB “culture” 
concerns, and the Task Group did not assess the studies ongoing within NASA pertaining to 
culture issues. Nonetheless, NASA has elected to implement an Agency-wide response to 
R9.1-1 through a document entitled “NASA Plan for Implementing Safe and Reliable 
Operations” (referred to as the “9.1-1 Plan”). 

Many of the CAIB organization observations are reflected in R7.5-1. The CAIB observed 
critical technical requirements were routinely waived and concluded the inherent conflicts of 
schedule, cost, and safety - the balance for which resided essentially with the Space Shuttle 
Program Manager - needed to be separated to provide an independent safety consideration. 

In regards to R7.5-2, the CAIB observed various parts of NASA were nominally responsible 
for “safety;” each NASA Center has safety organizations; each NASA program, including the 
Space Shuttle Program, has designated individuals responsible for safety; and NASA has an 
Office of Safety and Mission Assurance at Headquarters. This recommendation was intended 
to create clear lines of authority, responsibility, and communication, and help ensure 
independence by moving funding from NASA Centers and programs to NASA Headquarters. 

The CAIB found several aspects of Space Shuttle operations it believed to be suffering from 
incomplete integration, prompting them to write R7.5-3. Perhaps the most glaring was the 
apparent division of responsibility for addressing the separation of foam from the External 
Tank. Simplistically stated, the Orbiter Project thought it was up to those responsible for the 
tank to stop the shedding; the External Tank Project assumed the shedding occurring was not 
injurious to the Orbiter because no one told them otherwise. 

3.14.2 Background 

The accident board’s independent investigation revealed numerous areas in NASA’s 
organization and its operations requiring substantial improvement before returning the Space 
Shuttle to safe and reliable flight operations. The CAIB report specifically called for a 
detailed plan prior to the return to flight on three fundamental changes that NASA needed to 
make to improve the safety and reliability of its operations: 

• Restore specific engineering technical authority, independent of programmatic 
decision-making. 

• Increase authority, independence, and capability of the Safety and Mission 
Assurance (SMA) organizations. 

• Expand the role of the Space Shuttle Integration Office to address the entire 
Space Shuttle system, not just propulsive elements. 

3.14.3 NASA Implementation 

Once a plan for CAIB Recommendation 9.1-1 had been developed, NASA proceeded toward 
implementation. 
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3.14.3.1 Independent Technical Authority (R7.5-1) 

The NASA Chief Engineer, as the Independent Technical Authority, governs and is 
accountable for technical decisions affecting safe and reliable operations. The Independent 
Technical Authority provides technical decisions for safe and reliable operations in support of 
mission development activities and programs and projects that pose minimum reasonable risk 
to astronauts, the NASA workforce, and the public. Sound technical requirements necessary 
for safe and reliable operations will not be compromised by programmatic constraints, 
including cost and schedule. 

The Independent Technical Authority is also working to strengthen the technical conscience 
throughout the engineering community, that is, personal responsibility to provide safe 
technical products coupled with an awareness of avenues available to raise and resolve 
technical concerns. Technical authority and technical conscience represent a renewed culture 
in NASA governing and upholding sound technical decision-making by personnel who are 
independent of programmatic processes. This change affects how technical requirements are 
established and maintained as well as how technical decisions are made, safety considerations 
being first and foremost in technical decision-making. Five key principles govern the 
Independent Technical Authority. This authority: 

1. Resides in an individual, not an organization; 

2. Is clear and unambiguous regarding authority, responsibility, and accountability; 

3. Is independent of Program Management; 

4. Is executed using credible personnel, technical requirements, and decision¬ 
making tools; and 

5. Makes and influences technical decisions through prestige, visibility, and the 
strength of technical requirements and evaluations. 

3.14.3.1.1 Warrant System 

The Chief Engineer has put technical authority into practice through a system of governing 
warrants issued to individuals. These Technical Warrant Holders (TWH) are proven subject 
matter experts with mature judgment who are operating with an Independent Technical 
Authority budget that is separate from program budgets and program authority. This 
Independent Technical Authority budget covers the cost of the Technical Warrant Holders 
and their agents as they execute their responsibility for establishing and maintaining technical 
requirements, reviewing technical products, and preparing and administering technical 
processes and policies for disciplines and systems under their purview. 

The warrant system provides a disciplined formal procedure that is standardized across the 
Agency, and a process that is recognized inside and outside NASA in the execution of 
Independent Technical Authority. 

On November 23, 2004, the NASA Administrator issued the policy and requirements to 
implement Independent Technical Authority through a technical warrant process. This policy 
was issued under NPD 1240.4 NASA Technical Authority (draft) and NPR 1240.1 Technical 
Warrant System (draft), and is in accordance with the 9.1-1 Plan. The Chief Engineer has 
selected Technical Warrant Holders for many critical areas, including all major systems for 
the Space Shuttle. These Technical Warrant Holders are making technical decisions necessary 
for safe and reliable operations and are involved in return to flight activities for the Space 
Shuttle. NASA is selecting additional Technical Warrant Holders to span the full range of 
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technical disciplines and systems needed across the Agency. The Chief Engineer issued 
several new warrants in March 2005, including one for Systems Safety Engineering which 
will help revitalize the conduct of safety analyses (failure mode and effects analysis - FMEA, 
hazards analysis, reliability engineering, etc.) as part of design and engineering. The Chief 
Engineer will continue to issue warrants as required. 

3.14.3.1.2 Technical Conscience 

Technical conscience is personal ownership of the technical product by the individual who is 
responsible for that product. Committee reviews, supervisory initials, etc., do not relieve these 
individuals of their obligation for a safe and reliable mission operation if their technical 
requirements are followed. Technical conscience is also the personal principle for individuals 
to raise concerns regarding situations that do not “sit right” with the Agency’s mandate for 
safe and reliable systems and operations. With adoption of the Independent Technical 
Authority and the warrant system, technical personnel have the means to address and 
adjudicate technical concerns according to the requirements of the situation. The Independent 
Technical Authority and Technical Warrant Holders provide the means for independent 
evaluation and adjudication of any concern raised in exercising technical conscience. 

3.14.3.2 Safety and Mission Assurance (R7.5-2) 

To address the authority issue raised by the accident board, NASA has strengthened the 
traditional policy oversight over NASA programs provided by the Office of Safety and 
Mission Assurance (OSMA) with explicit authority of the Administrator through the Deputy 
Administrator to enforce those policies. The Chief Safety and Mission Assurance Officer 
provides leadership, policy direction, functional oversight, assessment, and coordination for 
the safety, quality, and mission assurance disciplines across the Agency. Operational 
responsibility for meeting the requirements of these disciplines rests with the Agency’s 
program and line organizations as an integral part of the NASA mission. To increase OSMA’s 
“line authority” over field SMA activities, NASA has taken four important steps: 

1. The Chief Safety and Mission Assurance Officer now has explicit authority over 
the selection, relief, and performance evaluation of all Center SMA Directors as 
well as the lead SMA managers for major programs — including Space Shuttle 
and International Space Station — and the Director of the Independent 
Verification and Validation (IV&V) Center. 

2. The Chief Safety and Mission Assurance Officer will provide a formal 
“functional performance evaluation” for each Center Director to their 
Headquarters Center Executive each year. 

3. “Suspension” authority is delegated to the Center Directors and their SMA 
Directors. This authority applies to any program, project, or operation conducted 
at the Center or under that Center’s SMA oversight regardless of whether the 
Center also has programmatic responsibility for that activity. 

4. The Safety and Mission Assurance community, through their institutional chain 
of command up to the Deputy Administrator, now has authority to decide the 
level of SMA support for the project/program. 

NASA safety and mission assurance support for the Space Shuttle Program consists of 
dedicated program office staff, technical support from the centers, and functional oversight 
from the Headquarters OSMA. The program’s SMA Manager reports directly to the Space 
Shuttle Program Manager and is responsible for execution of the safety and quality assurance 
requirements within the program. The program SMA Office integrates the safety and quality 
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assurance activities performed by all Centers for various projects and program elements 
located at those Centers. 

The Center SMA Directorates provide technical support to the program’s SMA Manager. 
They also provide independent safety and quality assurance functions in the form of 
independent assessments, safety, and reliability panel reviews. Finally, they provide a cadre of 
personnel dedicated to the Headquarters OSMA Independent Assessment function. 

3.14.3.2.1 SMA Independence 

The CAIB recommendation requires that OSMA be independently funded. After the Report of 
the Presidential Commission on the Space Shuttle Challenger Accident , also known as the 
Rogers Commission Report, NASA created the Office of Safety, Reliability and Quality 
Assurance, later renamed OSMA, and specifically set up its reporting and funding to be 
separate from the Office of the Chief Engineer and any of the programs. At the time of the 
Columbia accident, all funding for OSMA was in the general and administrative (G&A) line, 
separate from all other program, institutional, and mission support and functional support 
office funding. All permanent OSMA personnel are dedicated to OSMA and, therefore, 
independent of program or other mission support and functional support offices. This plan 
retains independent reporting and funding approach consistent with the CAIB 
recommendation. 

With respect to center-based civil servants and their support contractors performing safety, 
reliability, and quality assurance tasks, this plan calls for significant change. The 9.1-1 Plan 
establishes that the institution, not the program, decides SMA resource levels. Under the 
oversight of Headquarters Center Executives, centers will set up “directed service pools” to 
allow SMA labor to be applied to programs and projects in the areas and at levels deemed 
necessary by SMA Directors and their institutional chain of authority. The SMA Directors 
will pre-coordinate the use of their resources with the programs to foster understanding of 
how SMA labor will be used. This approach will guarantee both organizational and funding 
independence from the programs in a way that fully addresses the CAIB findings. Finally, the 
Headquarters OSMA will, for the first time, be a voting member of the Institutional 
Committee wherein institutional (including the directed service pool) budget decisions are 
made for the Agency. 

The prior definition of independence focused on organizational independence, and the Space 
Shuttle program and project managers had approval authority for about 99 percent (based on 
FY03 estimates) of total SMA funding level for Space Shuttle (including all contractor and 
Center NASA and support contractor SMA resources). The remaining 1 percent consisted of 
Center SMA supervisor time (paid by center general and administrative funds) and 
approximately $2 million per year of Space Shuttle Independent Assessment activity paid for 
by Headquarters OSMA. 

Under the new definition of independence, which now includes the directed service pool, the 
Space Shuttle Program has funding approval authority for only about 70 percent of the total 
SMA funding level. This funding pays for Space Shuttle prime and subcontractor SMA and 
for the small civil service SMA Management Office in the program. Remaining funding 
approval is accomplished through the directed service pool, and is therefore independent from 
the program. 

3.14.3.2.2 SMA Capability 

To address SMA capability, all centers have reviewed their safety and mission assurance 
skills and resources for adequacy and added positions as required. Headquarters OSMA has 
increased significantly its ability to provide functional oversight of all NASA safety and 
mission assurance programs. Staffing has been increased in the Headquarters office from 48 
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to 51 people, partly to accommodate increased liaison needs created by the addition of NASA 
Engineering and Safety Center (NESC), IV&V, and new assurance programs. At the time of 
the Columbia accident, OSMA had a budget of $6 million per year for Independent 
Assessments, its primary assurance tool. OSMA will continue to send Independent 
Assessment funding to the centers for use by SMA Directorates in performing center audits 
and supporting OSMA audits and assessment of resident programs. 

The NASA Engineering and Safety Center (NESC), as a technical resource available to the 
SMA community, in coordination with the ITA, combined with IV&V and Independent 
Assessment capabilities, provides an unprecedented increase in the independent assessment, 
audit, and review capability. This will reinforce the SMA community’s role in providing 
verification and assurance of compliance with technical requirements owned by the 
Independent Technical Authority, and in technical support for mishap investigations. 

The Independent Technical Authority will own all technical requirements, including safety 
and reliability design and engineering standards and requirements. OSMA will continue to 
develop and improve generic safety, reliability, and quality process standards, including 
FMEA, risk, and hazards analysis processes; however, the Independent Technical Authority 
will specify and approve these analyses and their application in engineering technical 
products. 

NASA is also improving its trend analysis, problem tracking, and lessons learned systems 
(CAIB Finding F7.4-9, -10, and -11), in a concerted effort to ensure the Independent 
Technical Authority invokes appropriate technical requirements. In order to improve OSMA 
insight and reduce the confusion cited in F7.4-13, NASA is formalizing its Prelaunch 
Assessment Review (PAR) process for the Space Shuttle and International Space Station, and 
the equivalent processes for expendable launch vehicles and experimental aerospace vehicle 
flight approvals, called Independent Mission Assurance Reviews (IMAR). Both processes 
have been standardized into a new NASA-wide review process called Safety and Mission 
Assurance Readiness Reviews (SMARR). 

In addressing the CAIB concern about the lack of mainstreaming and visibility of the system 
safety discipline (F7.4-4), OSMA has taken two actions, one long term and the other 
completed. First, the audit plan includes the project and/or line engineering assessment of the 
OSMA system safety engineering per new NASA policy directives for program management 
and ITA. Secondly, for some years the senior system safety expert in the Agency was also the 
OSMA Requirements Division Chief (now Deputy Chief, OSMA). To respond to the CAIB 
concern, OSMA has brought on a full-time experienced system safety manager who is the 
Agency’s dedicated senior system safety assurance policy expert. In addition, the Chief 
Engineer will select a Systems Safety Engineering Technical Warrant Holder who will be 
responsible for establishing systems safety engineering requirements. 

The SMA Directorates supporting the Space Shuttle Program are staffed with a combination 
of civil service and support contractors providing system safety, reliability, and quality 
expertise and services. Their role is predominantly assurance in nature, providing the program 
with functional oversight of the compliance with requirements of the contractor engineering 
and operations. The civil service personnel assigned to work on Space Shuttle are functionally 
tied to their Center SMA organizations, and although some are collocated with their project or 
contractor element, their official supervisors are in the Center SMA organization. 

The System Safety Review Panel (SSRP) process continues to evolve as the relationship 
between the ITA, SMA, and the Space Shuttle Program is defined and understood. This plan 
redefines the SSRP as the Engineering Risk Review Panels (ERRP). The ERRP is designed to 
improve engagement by the engineering community into the safety process, including the 
development and maintenance of documentation such as hazard reports. 
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The organizational structure of the ERRP will consist of Level II (Program) and Level III 
(Project/Element) functionality. The ERRP structure and process continues to evolve in a 
phased approach. Until return to flight, the Space Shuttle System Technical Warrant Holder 
will be represented at all ERRP levels through trusted agents who are assigned to support each 
ERRP. The trusted agents ensure that the engineering interests of the Independent Technical 
Authority are represented at all working levels of the ERRP and are reflected in the products 
resulting from these panels. After return to flight, the Shuttle System Technical Warrant 
Holder will reassess his/her role in all Space Shuttle Program panels and boards that deal with 
flight safety issues, including the ERRP. 

The Level II Panel will ensure that the safety integration function remains at the Program 
level. It will have representation by all program elements as well as the Engineering 
Directorate, ITA, and SMA. The Lead ERRP Manager will also assure that Level III panels 
operate in accordance with safety program requirements. The Level II Panel exists to oversee 
and resolve integrated hazards, forwarding them to the System Integration Configuration 
Board (SICB), and finally to the ITA and the Space Shuttle Program Manager for approval. 

The Level III ERRPs will consist of a Johnson Space Center (JSC) Panel dealing with 
the Orbiter, extravehicular activity, government-furnished equipment, and integration 
responsibility; a Marshall Space Flight Center (MSFC) Panel that handles the External Tank, 
Solid Rocket Booster, Reusable Solid Rocket Motor, and Space Shuttle Main Engine; and a 
Kennedy Space Center (KSC) Panel that deals with ground servicing equipment and ground 
operations. As presently defined, the Level III Panels will be chaired by the independent SMA 
Directorates at each center, again with representation by trusted agents at these panels. 

The Space Operations Mission Directorate Space Shuttle Certificate of Flight Readiness 
(CoFR) process is being updated to clearly show the new SMA, Integration, and Independent 
Technical Authority roles and responsibilities. Part of that will be a requirement for 
concurrence by the Chief Safety and Mission Assurance Officer on the flight readiness 
statement as a constraint to mission approval. 

3.14.3.3 Integration of the New ITA and SMA (R7.5-1/R7.5-2) 

In a practical sense, the people that perform the responsibilities of SMA and the ITA need to 
be involved within a program or project beginning in the early stages and continuing for the 
life of the program or project. CAIB Recommendation 7.5-1 defined what activities at the 
program level must be clearly controlled by the Independent Technical Authority. At the same 
time, Chapter 7 of the CAIB report makes it clear that the SMA organization must be 
independent of the program and technically capable to provide proper check-and-balance with 
the program. Finally, the SMA organization must be able to perform its assurance functions in 
support of but independent of both program and engineering organizations. 

The Independent Technical Authority has delegated fully to responsible individuals who hold 
warrants for systems and engineering disciplines. Fundamentally, this concept brings a 
“balance of power” to program management such that the Independent Technical Authority 
sets technical requirements, the programs execute to that set of technical requirements, and 
the SMA organization assures the requirements are satisfied. This means that the Independent 
Technical Authority owns the technical requirements and will be the waiver-granting 
authority for them. 

The principal effect of the foregoing is the clear assignment of responsibility for execution of 
design and engineering, including the safety functions (FMEA, hazards analysis, reliability 
engineering, etc.) to engineering with the Independent Technical Authority setting 
requirements and approving the resulting engineering products. In this context, SMA 
organizations have the responsibility for independently assuring that delivered products 
comply with requirements. 
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3.14.3.4 Systems Engineering and Integration (R7.5-3) 

The CAIB found several deficiencies in the organizational approach to program-wide system 
engineering integration for the Space Shuttle Program. Their Recommendation 7.5-3 calls for 
a reorganization of the Space Shuttle Integration Office to “make it capable of integrating all 
elements of the Space Shuttle Program, including the Orbiter.” The CAIB concluded, 
“...deficiencies in communication ...were a foundation for the Columbia accident. These 
deficiencies are byproducts of a cumbersome, bureaucratic, and highly complex Shuttle 
Program structure and the absence of authority in two key program areas that are responsible 
for integrating information across all programs and elements in the Shuttle program.” 

3.14.3.4.1 Integration Definition 

NASA defines integration as a system engineering function that combines the technical 
efforts of multiple system elements, functions, and disciplines to perform a higher-level 
system function in a manner that does not compromise the integrity of either the system or the 
individual elements. The integration function assesses, defines, and verifies the required 
characteristics of the interactions that exist between multiple system elements, functions, and 
disciplines, as these interactions converge to perform a higher-level function. 

3.14.3.4.2 Restructured Space Shuttle Systems Engineering and Integration Office 

NASA has restructured its Shuttle Integration Office into a Space Shuttle Systems 
Engineering and Integration Office (SEIO) to include the systems engineering and integration 
of all elements of the Space Shuttle system. The SEIO Manager now reports directly to the 
Space Shuttle Program Manager, thereby placing the SEIO at a level in the Space Shuttle 
organization that establishes the authority and accountability for integration of all Space 
Shuttle elements. The new SEIO charter clearly establishes that it is responsible for the 
systems engineering and integration of all Space Shuttle elements. The number of civil 
service personnel performing analytical and element systems engineering and integration in 
the SEIO was doubled by acquiring new personnel from the JSC Engineering and Mission 
Operations Directorates and from outside of NASA. The role of the System Integration Plan 
(SIP) and the Master Verification Plans (MVP) for all design changes with multi-element 
impact has been revitalized. The SEIO is now responsible for all SIPs and MVPs, including 
those developed for all major changes that impact multiple Space Shuttle elements. 

3.14.3.4.3 Orbiter Project Office 

The Space Shuttle Vehicle Engineering Office is now the Orbiter Project Office, and its 
charter is amended to clarify that SEIO is now responsible for integrating all flight elements. 
NASA reorganized and revitalized the Integration Control Board, with the Orbiter Project 
Office now a mandatory member. The Space Shuttle Flight Software organization was moved 
from the Orbiter Project into the SEIO. This reflects the fact that the Shuttle Flight Software 
Office manages multiple flight element software sources besides the Orbiter. 

3.14.3.4.4 Integration of Engineering at Centers 

All Space Shuttle Program integration functions at JSC, KSC, and MSFC are now 
coordinated through, and receive technical direction from, the SEIO. The former MSFC 
Propulsion Systems Integration office is now called the Propulsion Systems Engineering and 
Integration (PSE&I) office. Agreements between the PSE&I Project Office and the 
appropriate MSFC engineering organizations are being expanded to enhance anomaly 
resolution within the Space Shuttle Program. 
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3.14.3.4.5 Integrated Debris Environments/Certification 

The SEIO is also responsible for generation of all natural and induced design environments 
analyses. Debris is now treated as an integrated induced environment that will result in 
element design requirements for generation limits and impact tolerance. All flight elements 
are being reevaluated as potential debris generators. Computations of debris trajectories under 
a wide variety of conditions define the induced environment due to debris. The risk associated 
with the Orbiter Thermal Protection System will be reassessed for this debris environment, as 
will the systems of all flight elements. 

3.14.3.5 Summary 

The reorganized SEIO now addresses all elements of the Space Shuttle system including the 
Orbiter. The SEIO manager located at JSC has oversight and control of matrix Systems 
Engineering and Integration support from KSC and MSFC. SEIO works in compliance with 
Independent Technical Authority requirements and the SMA organization. SEIO recognizes 
the Independent Technical Authority as the approval authority for variances to technical 
requirements, as documented in NSTS 07700, Volume IV. Additionally, SEIO will conduct 
integrated hazard analyses with the oversight of the Space Shuttle System Technical Warrant 
Holder. The results of these analyses will be accepted or rejected by the Space Shuttle System 
Technical Warrant Holder prior to use. 

3.14.4 RTF TG Assessment 

In support of our assessment of CAIB Recommendation 9.1-1, the RTF TG conducted fact¬ 
finding with several former CAIB members, representatives of the NASA-Navy 
Benchmarking Team, and various senior NASA officials on numerous occasions during the 
last two years. 

CAIB required only a plan to implement the 7.5-series of recommendations before return to 
flight. The accident board, as did many of the Task Group, assumed that the return-to-flight 
would not be a two-plus-year endeavor and a plan was all that could be reasonably expected 
before the launch of STS-114. Thus, strictly speaking, NASA has largely complied with this 
recommendation. 

With the passage of time, however, the NASA Administrator announced his desire to have the 
elements of R9.1.1 implemented, at least for the Space Shuttle Program, before the return to 
flight. The Task Group has therefore been able to monitor the implementation of at least some 
of the plan, gauge early effects, and evaluate whether the individual elements of the 7.5-series 
of recommendations meet the intent of the CAIB. On that basis, the results are mixed. 

3.14.4.1 Recommendation 7.5-1: Independent Technical Authority 

The CAIB was concerned with the conflict of interest inherent in the Space Shuttle Program 
Manager balancing resources, schedule, and safety. In that role, prior to the Columbia 
accident, the program manager was often called upon to approve waivers of technical 
requirements - waivers that could compromise program safety - sometimes in order to meet 
schedule or budget constraints. 

The road to the current plan was neither straight nor smooth - there was a great deal of 
resistance from the safety community within NASA as well as from the various NASA 
centers. Some in the safety community view the current construct as a diminution of 
authority, with certain standards and waiver authority transferred to the ITA. The original 
assignment of NESC to SMA and its subsequent movement to the Chief Engineer was also 
viewed as a further relegation of authority. The NASA centers, maintaining their historical 
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position, argued that the accident board’s recommendation for Headquarters-level ITA was 
misguided - that centers are better able to manage technical authority. 

The Agency’s plan for implementing a new agency-wide Independent Technical Authority 
places waiver-approval in the hands of the Chief Engineer, who is independent of all 
programs. However, because of internal dissension, the final organizational structure of the 
Independent Technical Authority was only recently determined and full implementation has 
not yet been accomplished. The establishment of roles and responsibilities, in addition to 
technical waivers, is being determined in conjunction with the Office of Safety and Mission 
Assurance and the Systems Engineering and Integration Office. 

The Chief Engineer has chosen to exercise this authority through delegation to a series of 
Technical Warrant Holders. Each warrant holder is considered to be among the foremost 
technical experts in his or her field employed by NASA. Warrant holders essentially own the 
technical standards specified in their warrant and possess the discretion to change the 
standards and grant waivers to them. 

This construct is fully consistent with the intent of the CAIB. However, not all details of 
implementation have been worked out, especially the roles and responsibilities of the 
Independent Technical Authority relative to Office of Safety and Mission Assurance and the 
Systems Engineering and Integration Office. Further, while a number of warrant holders have 
been designated, not all will be in place before the return to flight. 

There also remains resistance within NASA to the totality of the change implied by the 
Independent Technical Authority concept. Nevertheless, the Agency’s implementation of this 
recommendation is viewed by many in Congress and the public as an indicator of the 
Agency’s willingness to change. Further implementation of the Independent Technical 
Authority and its durability will be of continued interest long after the return to flight. 
Ultimately, the sustainability of the Independent Technical Authority will be one measure of 
NASA’s willingness to change critical processes. 

3.14.4.2 Recommendation 7.5-2: Safety and Mission Assurance 

The CAIB viewed the organization of the Agency’s Space Shuttle safety offices as a 
contributing factor to NASA not being appropriately attuned to minimizing risks. They 
recommended: “NASA Headquarters Office of Safety and Mission Assurance should have 
direct line authority over the entire Space Shuttle Program safety organization and should be 
independently resourced.” 

After review, NASA determined it is preferable to keep the Center Directors in the line of 
authority so they retain some responsibility for safety. Therefore, NASA has chosen not to 
completely comply with the CAIB recommendation. Instead, they have increased the 
authority of Headquarters, but are keeping the director of each NASA Center responsible for 
safety and mission assurance by continuing to have each center’s SMA organizations report to 
the Center Director rather than the Chief Safety and Mission Assurance Officer at 
Headquarters. As part of these changes, NASA has strengthened the role Headquarters plays 
in employment and evaluation of safety personnel, and removed decisions for funding safety 
activities from the Space Shuttle Program. 

The Task Group has also noted OSMA efforts to enhance its auditing role - making sure that 
safety-related processes are adequate and implemented. Expanded auditing can help ensure 
that the remaining center-centric aspect of managing the safety organizations is not 
detrimental to the overall agency adoption of adequate safety systems. Like R7.5-1, the 
success of the implementation of this recommendation will require consistent attention by 
NASA leadership to ensure survival. 
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3.14.4.3 Recommendation 7.5-3: Systems Engineering and Integration 

The CAIB noted the apparent inability of the Space Shuttle Program to integrate across its 
various components. In the long history of NASA, integration has been the hallmark of both 
the challenges and successes of the Agency. In the particular case of the Columbia accident, 
foam from the External Tank inflicted catastrophic damage to the Orbiter. Previous instances 
of foam debris - including one just two flights prior to STS-107 - had not been taken 
sufficiently seriously by the managers of either the External Tank Project or the Orbiter 
Project. It appeared that no one was in charge of monitoring trends between and among 
flights, and data was generally unable to be shared between NASA Centers and program 
elements. The Agency’s capabilities for system engineering had atrophied. 

In response to the CAIB recommendation, NASA enhanced the reach and responsibilities of 
the SEIO operation within the Space Shuttle Program. Additional resources and personnel 
were added and new processes instituted. The integration function was improved and 
coordination between the program elements is more common. In addition, system analysis has 
improved; e.g., analytical modeling of debris flow. In strengthening system analysis and 
integration, the basic intent of R7.5-3 has been partially accomplished. 

However, weaknesses remain in the system engineering function and related processes. In 
many cases unverified and unvalidated analytical modeling is replacing sound engineering 
rationale as the hallmark of establishing engineering standards, measuring the attainment of 
technical requirements, and assessing risk. 

The Task Group and other outside observers (e.g., The Aerospace Corp. audit and NESC) 
have faulted NASA for inadequate documentation. Requirements have often been established 
long after design, testing, or hardware modifications have taken place; e.g., foam debris 
allowables, or repair material to be flown on the next flight manufactured prior to the 
completion of the establishment of requirements or formal design reviews. In some cases, 
such as ice debris from the External Tank, or software to control the bellows heaters, the 
requirements have yet to be established, as of the June 8, 2005 Task Group’s public meeting. 

Further, the SEIO management of the Design Certification Review/Design Verification 
Review (DCR/DVR) process for the return to flight has been inconsistent - each project has 
executed these critical processes in different manners, ranging from rigorous reviews to status 
reports. In many cases, minutes of the meetings were not published and required actions were 
not tracked. Information is therefore not systematically collected and may be lost or not easily 
accessible; e.g., the list of actions from the first Program DCR, conducted April 19, 2005, 
took over three weeks to assemble and consisted of different, non-collated lists contained in 
over half a dozen non-standardized files. 

3.14.4.4 Conclusion 

NASA has a mature plan to restructure the organization in response to the CAIB 
recommendation and therefore satisfies the letter of R9.1-1. Planned implementation of the 
Independent Technical Authority comports with CAIB intent - it will take some time to see if 
the process is robust enough to be sustainable. The planned response to R7.5-2 is intentionally 
not consistent with CAIB intent - NASA simply disagrees that the best organization for SMA 
is direct reporting to Headquarters. Implementation of R7.5-3 is uneven, with improved 
integration and system analysis but remaining gaps in system engineering capability. 

The RTF TG assessment of NASA’s actions was completed at the June 8, 2005 meeting. The 
intent of CAIB Recommendation 9.1-1 has been met. 
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3.14.5 RTF TG Observations 

The Task Group observes that the R9.1-1 plan is a first iteration, and the implementations of 
the 7.5-x recommendations are works in progress. Constant senior leadership vigilance of the 
implementation will be required to ensure maturity and resolve potential areas of conflict or 
confusion in terms of roles and responsibilities. The Task Group suggests that the Aerospace 
Safety Advisory Panel (ASAP) continue to review the ongoing implementation of the 7.5-x 
recommendations. 

Because of a lengthy NASA internal debate over the implementation of Recommendation 
R7.5-1, planning was not finalized until November 2004, resulting in a major organizational 
change to the program late in 2004. This resulted in confusion over roles and responsibilities 
and significant changes to program documentation immediately prior to the then-scheduled 
retum-to-flight launch of STS-114. Of particular importance for NASA leadership is to ensure 
that the Independent Technical Authority implementation fulfills one of its stated key 
principles, specifically, “clear and unambiguous ... authority, responsibility, and 
accountability.” 

Although not directly related to any CAIB recommendation, the Task Group applauds 
NASA’s establishment of the NASA Engineering and Safety Center (NESC) and observed 
valuable work produced by NESC. Over time, NASA leadership needs to ensure clarity of the 
NESC role (and more importantly, the NESC authority) in decision making. 

With respect to Recommendation R7.5-2, given the NASA alternative to “direct line 
reporting” and the history from Challenger to Columbia , the Task Group feels that significant 
NASA Headquarters leadership attention will be required to ensure SMA “independence” and 
appropriate authority. Enhancing Headquarters auditing capabilities and performance are 
critical to ensure this result. NASA Headquarters may wish to develop specific metrics and 
oversight to periodically ensure the independence and authority of critical SMA functions, 
including their performance in the Mission Management Team. 

Since the Space Shuttle SMA Manager is the voting member of the MMT, constant vigilance 
will need to be maintained to ensure the independence of the safety function and that close 
communications are maintained with those SMA directors which possess “suspension 
authority.” 

In regards to recommendation R7.5-3, the Task Group expects that NASA will address the 
remaining identified weaknesses in the systems engineering function and processes; will 
demand rigorous documentation that sustains effective systems integration and engineering; 
and will require improvements in standards for (and standardization of) validation, 
verification, and certification requirements for the development and use of analytical models. 

NASA further needs to assess the impact of its contractual relationships on effective systems 
engineering and integration. The Task Group was advised very shortly after its formation by 
Shuttle management that the Space Flight Operations Contract (SFOC) needed revitalization 
to ensure effective SEIO functions and/or those workforce capabilities reestablished in-house. 
The SSP needs to ensure that flight-to-flight verification and evolution of SEI databases are 
continuously updated, documented and appropriately provided for future flight and MMT 
decision making. 

The Task Group also observes that a significant workforce challenge is facing NASA. The 
Space Shuttle Program long ago transitioned, largely, to an “operations and maintenance” 
organization, losing the skill set and talents required to do the developmental work that was 
required post -Columbia. The Space Shuttle will remain a “developmental” vehicle until its 
retirement, and will require a developmental mindset, skill set, and discipline at both the 
workforce and management levels. 
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3.15 CAIB Recommendation 10.3-1 - 
Digitize Closeout Photos 

Develop an interim program of closeout photographs for all critical sub-systems that differ 
from engineering drawing. Digitize the closeout photograph system so that images are 
immediately available for on-orbit troubleshooting. 

3.15.1 RTF TG Interpretation 

During the investigation, the Columbia Accident Investigation Board (CAIB) encountered 
numerous engineering drawings that were inaccurate. Further, they discovered a large number 
of engineering change orders had not been incorporated into the drawings. Tied in with this, 
CAIB investigators were not able to access needed closeout photography for several weeks. 

3.15.2 Background 

Closeout photographs have been archived in a database at the Kennedy Space Center since the 
beginning of the program. (Closeout photos are pictures taken of Space Shuttle areas before 
they are sealed for flight.) This database was primarily used by the KSC engineering 
community and photos were filed based on the work authorization document that originally 
requested the photograph, making it difficult to search for particular images. A large number 
of non-standardized cameras were used resulting in arbitrary resolution of critical images. In 
addition, there were no clear requirements to photograph all critical closeout activities, or to 
record changes to the vehicle configuration. 

In the years since the Space Shuttle was designed, NASA has not updated many of its 
engineering drawings or converted to computer-aided drafting systems. The accident board’s 
review of those engineering drawings revealed numerous inaccuracies; in particular, the 
drawings do not incorporate many engineering changes made in the last two decades. Equally 
troubling was the difficulty in obtaining the drawings, accurate or not: some took up to four 
weeks to receive. Although some close-out photography was available as a substitute, these 
images took up to six weeks to obtain. The Aerospace Safety Advisory Panel noted similar 
difficulties in its 2001 and 2002 reports. 

3.15.3 NASA Implementation 

The Space Shuttle Program formed a Photo Closeout Team consisting of members from the 
engineering, quality, and technical communities to identify and implement necessary 
upgrades to the processes and equipment involved in vehicle closeout photography. Kennedy 
Space Center (KSC) closeout photography includes the Orbiter, External Tank, Solid Rocket 
Boosters, and Space Shuttle Main Engines, based on project requirements. The Photo 
Closeout Team divided the CAIB recommendation into two main elements: (1) increasing the 
quantity and quality of closeout photographs, and (2) improving the retrieval process through 
a user-friendly web-based graphical interface system. 

Led by the Photo Closeout Team, the Space Shuttle Program completed an extensive review 
of existing closeout photo requirements. This team systematically identified the deficiencies 
of the current system and assembled and prioritized improvements for all elements. These 
priorities were distilled into a set of revised requirements that has been incorporated into 
program documentation. NASA also added a formal photography step for KSC-generated 
documentation and mandated that photography of all Material Review Board (MRB) reports 
be archived in the Shuttle Image Management System (SIMS) database. These MRB problem 
reports provide formal documentation of known subsystem and component discrepancies, 
such as differences from engineering drawings. 
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The Nikon D100 
digital camera 
provides a resolution 
of 6.1 megapixels. 


The Shuttle Image 
Management System 
(SIMS) database 
features a graphical 
interface. 


To meet the new requirements and ensure a comprehensive and accurate database of photos, 
the Kennedy Space Center established a baseline for photographic equipment and quality 
standards, initiated a training and certification program to ensure all operators understand and 
can meet these requirements, and improved the SIMS. To verify the quality of photographs 
taken and archived, NASA has developed an ongoing process that calls for SIMS 
administrators to continually audit the photos being submitted for archiving in the SIMS. 
Photographers who fail to meet the photo requirements will lose their certification pending 
further training. Additionally, to ensure the robustness of the archive, poor-quality photos will 
not be archived. 


NASA determined the minimum resolution for 
closeout photography should be 6.1 megapixels to 
provide the necessary clarity and detail. KSC has 
procured 36 Nikon D100 6.1 megapixel cameras 
and completed a test program in cooperation with 
Nikon to ensure the cameras meet the Agency’s 
requirements. 

To improve the accessibility of the SIMS database, 
NASA developed a web-based graphical interface. 
Users can easily view the desired Space Shuttle 
elements and systems and quickly drill down to 
specific components, as well as select photos from 
specific Orbiters and missions. SIMS also includes 
hardware reference drawings to help users identify 
hardware locations by zones. These enhancements will enable Mission Evaluation Room and 
Mission Management Team personnel to quickly and intuitively access relevant photos 
without lengthy searches, improving their ability to respond to contingencies. 




NASA has revised the Operation and Maintenance Requirements System to mandate that 
general closeout photography be performed at the time of normal closeout inspection process 
and that digital photographs be archived in SIMS. Overlapping photographs will be taken to 
capture large areas. NSTS 07700, Volume IV and the KSC MRB Operating Procedure have 
also been updated to mandate photography of visible MRB conditions be entered into the 
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SIMS closeout photography database. This requirement ensures all known critical subsystem 
configurations that differ from Engineering Drawings are documented and available in SIMS 
to aid in engineering evaluation and on-orbit troubleshooting. 



Each Space Shuttle 
element is 
represented in the 
SIMS database. 


Training for critical personnel is complete, and will be ongoing to ensure the broadest 
possible dissemination within the user community. Photographer training is complete and 
associated classes are taught on a regular basis. SIMS computer-based training has been 
developed and released. Use of SIMS has been successfully demonstrated in a launch 
countdown simulation at KSC, which included participation from the KSC Launch Team, JSC 
Flight Control Team, Mission Evaluation Room, MSFC Huntsville Operations and Support 
Center, and the Systems Engineering and Integration Office. 

3.15.4 RTF TG Assessment 

The Task Group conducted numerous fact-finding activities during 2004 concerning closeout 
photography and the SIMS database. These efforts complemented earlier meetings with KSC 
staff and their contractors to review their response to the CAIB recommendation in December 
2003. New standardized 6.1 megapixel cameras have been acquired and are now being used 
in closeout and configuration photography. Generic and return to flight-specific closeout 
photo requirements have been established by program elements and documented. 
Photography of areas already closed has been deemed adequate. NASA identified 
enhancements to the SIMS and the necessary upgrades are complete. Updated training 
material has been developed for users of the SIMS database and users have received training 
at the Kennedy Space Center, Johnson Space Center, and Marshall Space Flight Center from 
local trainers. Through several integrated launch countdown simulations, the Space Shuttle 
Program staff has confirmed that the modifications to the SIMS database satisfy their needs. 

When the accident board wrote their recommendations, they assumed that the Space Shuttle 
Program would continue for the long term, and indicated digital photography could provide 
an interim solution pending the digitizing and updating of all Space Shuttle engineering 
drawings (R10.3-2). However, based on the National Policy decision to retire the Space 
Shuttle no later than 2010, the Task Group concurs with the NASA decision that it does not 
make economic sense to expend the resources to make major changes to the drawings. The 
digital closeout photography provides an adequate solution until the end of the program. 
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However, if the Space Shuttle Program is extended past 2010, or if a Shuttle-Derived Launch 
Vehicle (SDLV) is selected as a future booster, this decision should be reevaluated. 

The RTF TG initial assessment of NASA’s actions was completed at the July 22, 2004, 
teleconference plenary where the assessment was conditionally closed. After receiving 
additional information from NASA, the assessment was fully closed at the December 16, 
2004, meeting. The intent of CAIB Recommendation 10.3-1 has been met. 

3.15.5 RTF TG Observation 

If the Space Shuttle Program is extended past 2010, or a Shuttle-Derived Launch Vehicle 
(SDLV) is selected as a future booster, the decision concerning updating the Space Shuttle 
engineering drawings should be reevaluated. 


Actual photographs 
from the SIMS 
database of 
STS-114. On the left, 
a photo of the liquid 
oxygen feedline 
where it comes out 
of the External Tank; 
on the right, a shot of 
the inside of a piece 
of the reinforced 
carbon-carbon wing 
leading edge panel. 



More photographs 
from SIMS. At left is 
a turbopump impeller 
on a Space Shuttle 
Main Engine; at right, 
the bolts around a 
field joint of a Solid 
Rocket Booster. 



More from the SIMS 
database. At left, the 
forward Orbiter- 
External Tank attach 
point; at right, the left 
main landing gear of 
Discovery. 
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3.16 Raising the Bar Action SSP-3 - 

Contingency Shuttle Crew Support 

NASA Implementation Plan: NASA will evaluate the feasibility of providing contingency life 
support on board the International Space Station (ISS) to stranded Shuttle crew members 
until repair or rescue can be accomplished. 

3.16.1 RTF TG Interpretation 

Space Shuttle Program Action 3 (SSP-3) addresses Contingency Shuttle Crew Support 
(CSCS), the capability to harbor Space Shuttle crewmembers aboard the International Space 
Station (ISS) until a damaged Orbiter can be repaired or the crew rescued. The Columbia 
Accident Investigation Board (CAIB) did not make a specific recommendation with regard to 
CSCS, but Section 9.1 of the CAIB report listed the exploration of “all options for survival, 
such as provisions for...safe havens” as one of several necessary measures for safe flight. 
Section 6.4 of the CAIB report also assesses the possibility of rescuing a crew by launching 
another Space Shuttle. 

3.16.2 Background 

In the aftermath of the Columbia accident, NASA responded with a set of corrective actions 
characterized as “raising the bar” - not required by the CAIB for returning to flight, but self- 
imposed by the Space Shuttle Program. These actions are documented in the NASA 
Implementation Plan. One of these actions resulted in NASA examining options for providing 
a capability to sustain a Space Shuttle crew on the ISS should the Orbiter become unfit for 
entry. NASA chose to pursue CSCS as a functional emergency capability that is not certified, 
similar to how NASA addresses other emergency plans. Thus CSCS is not intended to 
mitigate known but unacceptable risks; rather, it is a contingency plan of last resort with 
limited capability to sustain the crew on the ISS. Finally, NASA committed to ensuring that a 
rescue Space Shuttle will be available for at least its next two flights. In fact, NASA 
leadership committed to the delay launch of STS-114 and STS-121, if necessary, until a 
rescue vehicle can be ready within the projected CSCS window. 

The Task Group chose to assess SSP-3 because NASA uses the CSCS capability as part of its 
launch rationale, and because NASA considers the ability to launch a rescue vehicle within 
estimated CSCS duration to be a constraint to launch for the first two return-to-flight 
missions. The CSCS capability bears on the safety and operational readiness of STS-114 and 
therefore falls within the purview of the Task Group to evaluate. 

3.16.3 NASA Implementation 

On June 9, 2004, the Space Flight Leadership Council approved pursuing the CSCS concept 
as an emergency capability for the first two return-to-flight missions, STS-114 and STS-121. 
NASA will revisit the feasibility and need for continued CSCS capability following STS-121. 

The CSCS capability will not be fault tolerant, and imposes no additional requirements for 
fault tolerance other than those that already exist. The capability is built on the presumption 
that, if necessary, all ISS consumables and Orbiter reserves will be depleted to support the 
combined crews aboard the ISS until a rescue mission can be launched. In the most extreme 
CSCS scenarios, it is possible that the ISS crew will need to return to Earth following the 
rescue of the Space Shuttle crew until consumables margins can be reestablished and a 
favorable safety review is completed. 

For the first two flights, NASA will ensure the capability to launch a rescue mission is 
available within the time period the International Space Station can reasonably sustain the 
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combined crews of the ISS and the stricken Orbiter. This includes allowing sufficient time to 
evacuate the ISS following departure of the rescue Space Shuttle, if necessary. This time 
period, referred to as the International Space Station engineering estimate of supportable 
CSCS duration, represents a point between worst- and best-case scenarios based on 
operational experience and engineering judgment. The ISS Program will provide this estimate 
in advance of the first two retum-to-flight missions as a part of the flight preparation process. 

To arrive at the engineering estimate, the ISS Program analyzed the impacts of maintaining 
seven additional people on the ISS in the event of CSCS. Their analyses indicate that at 
current operating levels, and with conservative assumptions of system viability, the combined 
crews can be supported long enough to allow the launch of a rescue mission. As consumables 
aboard the International Space Station are used by the normal crew prior to the launch of 
STS-114, the CSCS engineering estimate will change. The engineering estimate will be 
updated at specific milestones during the STS-114 mission planning process. 

As part of the CSCS concept, NASA will have a second Space Shuttle, designated STS-300 
for STS-114 and STS-301 for STS-121, ready for launch on short notice. The Space Flight 
Leadership Council has directed the ability to launch a rescue mission within the ISS Program 
engineering estimate will be a constraint to launch for the first two missions. 

Should a rescue mission become necessary, it would be subject to the same requirements as 
any other Space Shuttle mission, but processed on an accelerated schedule. The rescue Orbiter 
would be reconfigured with additional accommodations, including seating, for the crew of the 
stricken Orbiter. 


The International 
Space Station (ISS) 
could provide a safe 
haven for the crew of 
a damaged Orbiter 
using the 
Contingency Shuttle 
Crew Support 
capability described 
in SSP-3. 
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The rescue Orbiter, Atlantis for STS-300 and Discovery for STS-301, would be crewed by 
four astronauts. Following launch, the rescue Orbiter would dock with the ISS using standard 
rendezvous and approach procedures. Any extra consumables would be transferred to the ISS. 
The stranded Orbiter crew would board the rescue Orbiter and return to Earth with the four 
rescue astronauts. If evacuation of ISS becomes necessary, the ISS crew would return to Earth 
via the Soyuz spacecraft docked at the ISS. 

Since, as currently configured, the ISS can only dock one Orbiter at a time, the stricken 
Orbiter must be undocked prior to arrival of the rescue Orbiter. NASA has developed 
procedures for undocking an unmanned Orbiter from the station, separating to a safe distance, 
then conducting a deorbit bum that will cause the Orbiter to enter and bum-up over an 
uninhabited oceanic area. These procedures have been developed in detail through the ISS 
Safe Haven Joint Operations Panel, and have been simulated in a joint integrated simulation 
involving flight controllers and flight crews from both the International Space Station 
Program and the Space Shuttle Program. 

The decision to implement CSCS would result in extremely serious consequences, including: 
exposure of the stricken Orbiter crew to a severe survival situation presenting the distinct 
possibility of loss of life; exposure of the rescue Orbiter crew to flying a vehicle possibly 
vulnerable to the same failure(s) that stranded the first Orbiter; the loss of an irreplaceable 
National asset (the stricken Orbiter); possible depletion of ISS resources to a level requiring 
evacuation of ISS; and the likely termination of all future Space Shuttle missions, 
significantly restricting the United State’s human access to space and utilization of the 
International Space Station. 

Given these extreme consequences of implementing CSCS, the Space Flight Leadership 
Council has made it clear that the Mission Management Team (MMT) will be responsible for 
orchestrating a recommendation to implement CSCS only upon clear evidence of catastrophic 
Thermal Protection System damage that cannot be satisfactorily repaired. Such a 
recommendation would be accompanied by an assessment of the risk of repeating the 
failure(s) that damaged the first Orbiter. This would be aided by the enhancements to the 
ascent and on-orbit imagery collection and analysis made since the Columbia accident. The 
MMT would make its recommendation through the Deputy Associate Administrator for 
International Space Station and Space Shuttle Programs to the Associate Administrator for 
Space Operations. The final risk-versus-risk trade and decision to implement CSCS, or not, 
would be made at the Agency level with appropriate notification to National Authorities. 

3.16.4 RTF TG Assessment 

Since the CSCS capability was not a CAIB recommendation, the Task Group had no 
predefined criteria to evaluate the capability against. Instead, the RTF TG established five 
conditions that it believed constituted an adequate CSCS contingency capability: 

1. Clear articulation of the role CSCS plays in NASA’s risk management 
framework for damage to the Orbiter Thermal Protection System from debris. 

2. Development of a dynamic, rigorous analytic process for estimating the number 
of days the ISS could sustain the seven crew stranded by a damaged Orbiter in 
addition to its two crewmembers. 

3. Development and demonstration of a robust plan for launching a rescue Orbiter, 
including safely undocking and de-orbiting a damaged Space Shuttle. 

4. Integration of CSCS plans and estimates into the pre-launch decision process 
and relevant documents. 
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5. Integration of the CSCS capability into the Mission Management Team (MMT) 
decision-making process, including a demonstration of its ability to consider the 
risk-versus-risk trades inherent in invoking CSCS, to make informed decisions 
in the face of these risks, and to implement CSCS procedures. 

This assessment is based on information that emerged from various fact-finding activities. 
Most prominent among these were a series of meetings between the RTF TG Operations 
Panel and NASA representatives, beginning on July 8, 2004. The objective of this meeting 
was to help the Operations Panel obtain a high-level understanding of the NASA Thermal 
Protection System risk reduction framework, the role of CSCS in that framework, and the 
extent to which NASA intended to develop the CSCS capability. The second meeting took 
place on August 10, 2004, to help understand the analytic approach by which NASA will 
estimate possible CSCS duration. Of particular concern was the health, stability, and 
resilience of the ISS habitat under the stress of nine people. 

In March, 2005, the Task Group observed the performance of the MMT during a simulation 
(sim #12), the objectives of which included analysis of tile damage and decision-making with 
regard to repair and the possibility of CSCS. Subsequently, a third fact-finding meeting 
occurred on March 22, 2005, to discern the extent to which the MMT had exercised the CSCS 
decision process. The fourth fact-finding meeting was on April 7, 2005, primarily to ascertain 
the NASA simulation supervisors’ assessment of the MMT ability to make decisions 
regarding CSCS, as demonstrated in various simulations. The fifth meeting took place on 
April 8 where the NASA simulation supervisors reviewed the training strategy for an 
additional MMT simulation (sim #13) targeted at the MMT decision-making process 
regarding repair, entry, and CSCS. Finally, on May 4, 2005, the Task Group observed the 
simulation in which the MMT was confronted with the choice between entry on an uncertified 
tile repair or the declaration of CSCS. 

The outcomes of these meetings, coupled with additional discussions, review of 
documentation, and the responses NASA provided to thirteen requests for information, form 
the basis for the Task group’s assessment of SSP-3. Overall, the RTF TG finds that NASA set 
a Raising the Bar action for themselves and exceeded it by a significant margin. The Task 
Group commends NASA for its excellent work on SSP-3. This conclusion is derived from the 
following assessments against the five conditions specified above for successful SSP-3 
implementation. 

3.16.4.1 Condition 1: Risk Reduction 

The NASA return-to-flight approach is founded on a framework for TPS risk reduction that 
has five hierarchically interrelated components: elimination of critical debris, impact detection 
during ascent, on-orbit damage detection, TPS repair, and crew rescue. 1 The Agency’s core 
risk management strategy has been to eliminate critical debris sources. Despite these efforts, 
there remains some probability that debris could cause catastrophic damage, although NASA 
expects to be able to generate an accepted risk rationale. To reduce this residual risk enough 
to accept it and provide adequate flight rationale, NASA intends to rely on a set of strategies 
and capabilities first to detect damage to the Orbiter through sensing, imaging, and on-orbit 
inspection, and then to either effect repair or rescue the crew with another Space Shuttle. 

Each of these capabilities faces technical challenges that create uncertainty about its viability 
and utility. Crew rescue also involves uncertainties associated with providing life support for 
the Space Shuttle and Space Station crews aboard ISS, undocking and de-orbiting the 
damaged Orbiter, and the launch of a rescue vehicle into a risk environment where damage, 


1 This approach is documented in The Integrated Risk Acceptance Approach for Return to Flight , May 
2005. 
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potentially from unknown or not-well-understood causes, has already occurred. Furthermore, 
CSCS itself exposes the crews aboard the ISS to the risks inherent in operating in a survival 
mode. Finally, CSCS may deplete ISS consumables and systems to the point that the ISS must 
be evacuated. In sum, a decision to invoke CSCS poses a severe threat to the future of the 
Space Shuttle Program and the International Space Station Program. 

These concerns prompted the RTF TG to query NASA about assessments of these 
uncertainties and risks, and of other unintended consequences that may result from CSCS. 
NASA reports that the Space Flight Leadership Council (SFLC) has discussed these risks and 
consequences “at various forums,” although they did not provide documentation of those 
discussions. They admitted that “no formal preflight assessment has been performed,” and 
intend to make a real-time assessment of the risk of rescue versus the risk of repair versus the 
risk of entry, should TPS damage occur. It is the sense of the RTF TG that while NASA 
recognizes these risks and the magnitude of potential consequences, they have not 
systematically developed a mature appreciation of this trade space. 

Nonetheless, it is conceivable the aggregate benefits of these capabilities to crew survival will 
outweigh these risks, therefore providing sufficient justification for NASA to accept the 
residual risk of damage to TPS that remains after mitigation of critical debris. NASA has 
appropriately developed CSCS as a viable but limited contingency capability to be invoked 
only under particular circumstances of extreme emergency. These circumstances are confined 
to Orbiter TPS anomalies only (and not to other system failures), and further to cases where 
Orbiter TPS has suffered damage that cannot be repaired adequately to permit safe entry, and 
therefore the lives of the Space Shuttle crew are in jeopardy. In other words, CSCS is a last 
resort in the event of a catastrophic damage scenario. Since most of the mitigation for risk 
associated with critical debris is based on the efforts to reduce the foam shedding of the 
External Tank, the major burden of risk mitigation is not required of the CSCS capability. 
Thus, NASA has chosen not to make CSCS a “certified” contingency. This is a choice that the 
RTF TG endorses, since it would require extreme efforts to balance logistic resources and 
manage ground-breaking international agreements - efforts disproportionate given the 
probability of a CSCS declaration. The CSCS capability is, nonetheless, an integral 
component of NASA’s TPS risk management strategy that, in conjunction with other 
capabilities, can help NASA accept the residual risk that remains despite efforts to mitigate all 
sources of critical debris. To be a viable component of overall risk reduction, though, CSCS 
must be a capability that can be reasonably executed in a survival mode, therefore a vigorous 
analysis is required to determine ISS duration estimates that exceed the time necessary to 
launch a rescue mission. 

3.16.4.2 Condition 2: Engineering Analysis 

The centerpiece of CSCS is an engineering analysis that supports ISS habitability for nine 
people for a predicted duration; therefore this analysis must thoroughly address issues such as 
consumables, ISS Environmental Control and Life Support System (ECLSS) functionality, 
systemic ISS biosphere stability, stowage, crew protocols for food and exercise, and impacts 
from changes to launch schedules and vehicle manifests. NASA understands this need, and 
has developed an excellent engineering assessment process that provides an estimate of 
possible CSCS duration. 

The International Space Station Program completed a study of the ability to support a one 
fault tolerant CSCS capability, and presented these recommendations to the Space Flight 
Leadership Council on June 9, 2004. The ISS Program has defined the following ECLSS 
functions as critical: carbon dioxide (C02) control and disposal, oxygen (02) generation and 
supply, water supply and recovery, and waste management. 2 The ISS Program’s June study 


2 ISS Contingency Crew Support (in support of STS TPS Anomaly) Status presentation to the SFLC, 
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concluded the ISS will be unable to meet one-fault tolerance in several important areas. Thus 
the CSCS capability is considered zero-fault tolerant overall, although some systems (e.g. 
temperature/humidity control and trace contaminant control) are as much as two-fault 
tolerant. Nonetheless, CSCS will not be a certified capability, since the ISS is only certified 
for a crew of six on a temporary basis and a crew of three on a permanent basis (without 
Space Shuttle support). Also, NASA is assuming that “STS-114 will require no newly 
developed Shuttle or ISS performance capabilities to enable CSCS.” 3 

It is also important to recognize that NASA is scoping CSCS possibilities “in-house,” and will 
not coordinate formally with the Russian Federal Space Agency (FKA) to extend FKA 
commitments beyond their current levels. The FKA has explicitly stated that it does not 
endorse the CSCS concept. The basis of the FKA position is an operational philosophy - 
advanced by the United States - that rejects having any more crew aboard ISS than there are 
“lifeboat” seats available for. The FKA did not comment on the adequacy of ISS consumables 
to support the CSCS plan. Furthermore, through informal discussions, NASA analysts are 
aware that their Russians counterparts believe there is unexploited margin in the estimated 
performance of their systems. 

NASA published an L-l-month assessment that included an estimated CSCS duration for 
STS-114 of 43 days, given a May 15, 2005 launch. 4 NASA will revise this analysis as the 
status of systems and consumables aboard the ISS, Progress schedules, and STS-114 launch 
date vary. The engineering duration estimate is not, however, a stable figure; it can fluctuate 
as a result of changes in several conditions to which it is particularly sensitive, including: 

• Progress [Russian ISS supply vehicle] schedule, which directly affects the levels 
of consumables aboard the ISS; 

• Space Shuttle launch schedule, which likewise drives consumable levels and 
requirements; 

• Current operational status of all environmental systems aboard the ISS, and the 
occurrence of failures in these systems; 

• Plans for and assumptions about crew consumption; and 

• Plans for, and assumptions about, Space Shuttle manifests, particularly 
regarding spares and consumables. 

The fluidity inherent in the engineering estimate is mitigated to some extent by the fact that 
the prediction rests as much as possible on U.S. systems, and makes very conservative 
estimates about the performance of Russian systems (or omits them from consideration 
altogether). Moreover, the duration estimate could likely be extended through power-downs, 
resource-saving measures, and additional supplies/spares. Regardless, the stability and 
validity of the engineering estimate depends on good coordination and information flow 
between the International Space Station Program and the Space Shuttle Program. 


June 9, 2004. 

3 NASA’s Implementation Plan for Space Shuttle Return to Flight and Beyond , (Tenth Edition, June 3, 
2005, p.2-6). 

4 According to NASA, “ISS ECLS engineering team has evaluated all of the critical ISS ECLS 
systems. Based on the current system status, past history, and current on-orbit consumables, the 
limiting system is oxygen supply, which can provide a 43-day CSCS TPS duration support.” (“STS- 
114 (LF-1) L-l Month Duration Report of the Environmental Control and Life Support Systems 
(ECLSS) Contingency Shuttle Crew Support (CSCS) for Thermal Protection System (TPS) Failure,” 
March 2005, p. 24.) 
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Overall, the RTF TG believes that CSCS protocols must rest on a thorough engineering 
analysis that specifies the parameters under which CSCS is likely to be technically possible. It 
is our assessment that NASA has developed and demonstrated a sound approach to such an 
analysis. 

3.16.4.3 Condition 3: Rescue Space Shuttle 

Invocation of CSCS necessitates a rescue mission. For STS-114 and STS-121, the Space 
Flight Leadership Council has mandated that the Space Shuttle Program be able to launch a 
rescue mission within the ISS engineering estimate of CSCS duration. In the event of CSCS, 
NASA has developed a plan for launching a rescue Space Shuttle that would have a crew of 
four, and would return with the stranded Orbiter crew within the duration defined by the ISS 
Program. If evacuating the ISS becomes necessary as a result of depletion of ISS systems and 
consumables, the ISS crew would return via the Soyuz spacecraft already docked at the ISS. 

Since only one Orbiter can dock to ISS, safe undock and de-orbit procedures for the damaged 
Orbiter are also necessary. The JSC Mission Operations Directorate has developed procedures 
for undocking an unmanned Orbiter from the ISS, separating to a safe distance, and then 
conducting a de-orbit bum to dispose the damaged Orbiter into an uninhabited oceanic area. 
These procedures have been exercised successfully in a joint integrated simulation involving 
flight controllers and flight crews from both the ISS Program and the Space Shuttle Program. 

The Task Group’s assessment is that NASA understands these processes well, and the RTF 
TG has confidence in their capability to execute them. The prominent concern associated with 
the launch of a rescue Space Shuttle is that it requires exposing the rescue Orbiter to the same 
potential for sustaining damage as that which stranded the primary vehicle. NASA is aware of 
this risk, although, as noted above, no formal assessment of this risk can be performed until 
the specific cause of the damage to the primary vehicle has been determined. 

3.16.4.4 Condition 4: Launch Decision Process 

The requirement to launch a rescue Space Shuttle imposes a need for NASA to address CSCS 
in its launch decision process, because it will have to specify the timeframe within which 
STS-300 must be ready to launch and CSCS requires coordination between the Space Shuttle 
Program and the International Space Station Program. CSCS processes are documented in a 
Memorandum of Agreement between the programs, which jointly analyze and report CSCS 
capabilities at L-6 months, L-3 months, L-l month, and the L-2 week Flight Readiness 
Review. Updates to the estimate will be provided at the L-2-day and L-l-day MMT meetings, 
the L-9 hour pre-tanking meeting, and final go/no-go poll during the T-9 minute hold. If 
failures are reported during any of these updates, the MMT will assess their impact, and 
decide whether to continue or scrub the launch. NASA does not intend to write launch 
commit criteria to automatically abort a launch for late ISS failures which might create a gap 
in CSCS capability. 

It is the RTF TG’s assessment that the process for reporting and updating CSCS capability in 
the period before launch is appropriate. 

3.16.4.5 Condition 5: MMT Capability 

NASA asserts it will implement CSCS only upon clear evidence of catastrophic TPS damage 
that cannot be repaired. It has also determined that a CSCS decision will be made at the 
agency level, supported by MMT recommendations. The decision process by which the MMT 
would arrive at a CSCS recommendation is extremely difficult, and the potential 
consequences of CSCS implementation are momentous. Thus, invocation of CSCS requires 
complex risk-versus-risk assessments regarding whether to repair, entry, or launch a rescue 
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Space Shuttle that are fraught with uncertainty and ambiguity. To reduce uncertainty, these 
decisions will require the rapid assessment of data from multiple sources. To reduce 
ambiguity, these decisions will require close collaboration among MMT members to develop 
a common view of the severity of the risks. 

Given how central these decisions about repair, entry, CSCS, and rescue are to the NASA risk 
architecture, and how challenging this decision process would be, the RTF TG believed that it 
was important for the MMT to exercise and demonstrate this decision-making and analytic 
process prior to flight. The RTF TG asked NASA to “demonstrate the MMT process to weigh 
and evaluate the risk of CSCS relative to other options in an integrated simulation; 
demonstrate how the MMT will build a rationale for launching the rescue vehicle; and 
demonstrate the MMT, MER, and FCT process to evaluate and consider unintended 
consequences resulting from calling CSCS.” 

NASA believed they had fulfilled the RTF TG request during an MMT simulation held in 
early March, 2005 (sim #12). According to the simulation supervisor, the objectives of the 
sim included analysis of tile damage and decision-making with regard to repair and the 
possibility of CSCS. The simulation supervisor was satisfied with the MMT performance 
relative to this stated intent. Likewise, the chair of the MMT believed the MMT thought 
carefully about the implications of repairing the TPS versus invoking CSCS. While MMT sim 
#12 was a very important exercise that did appear to enhance the capacity of the MMT 
overall, RTF TG observers present during the simulation witnessed little systematic 
discussion with regard to CSCS specifically, and believed that NASA failed to fully confront 
- and ultimately make - the central, difficult risk-risk choices given circumstances where 
damage cannot be fully assessed, repairs may not be reliable, and a rescue launch may sustain 
similar debilitating damage. The minutes from the MMT meetings during the simulation also 
revealed little such discussion. Furthermore, the RTF TG discovered that the ISS team 
contribution to the MMT sim #12 scenario was relatively static, so that little discussion of the 
impacts on CSCS of the extra consumables used during the planned tile repair was possible. 

Based in part on these concerns, NASA subsequently added another MMT simulation (sim 
#13) to the schedule, with the objective of completing the scenario that was started in MMT 
sim #12. Making the critical choice of whether or not to ride a repair to the ground, and 
performing the risk-versus-risk analysis in the process, were the driving goals for this 
simulation. In the end, the MMT did review pertinent risk for the major options, and did a 
greatly improved job of evaluating the CSCS/LON option. Critical factors related to CSCS 
duration were discussed, and the view of CSCS as a last-resort option was appropriately held 
by the MMT members. In the end, the MMT unanimously decided to attempt the return from 
orbit with the uncertified tile repair, but the rationale for this decision was logically and 
thoroughly discussed. 

3.16.4.6 Conclusion 

While the RTF TG believes weaknesses remain in NASA’s demonstration of their capacity to 
handle a CSCS decision, the MMT clearly has made important progress since the loss of 
Columbia , and its overall decision-making ability is much improved. The RTF TG believes 
the MMT is capable of addressing a CSCS decision appropriately. 

The Task Group’s assessment of NASA’s actions was completed at the June 8, 2005, meeting. 
The RTF TG commends the Agency for its excellent work on SSP-3, and believes that NASA 
set a raising the bar goal for itself and exceeded that goal by a significant margin. 

3.16.5 RTF TG Observation 

RTF TG Observations concerning the MMT role in CSCS are provided in Section 3.11. 
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4 TRANSITION TO THE ASAP 

The Aerospace Safety Advisory Panel (ASAP) is a senior advisory committee that reports to 
the NASA Administrator and Congress. The Panel was established by Congress after the 
Apollo 204 Command Module (“Apollo 1”) spacecraft fire in January 1967 to advise NASA 
on the safety of operations, facilities, and personnel. 

The statutory duties of the ASAP, as prescribed in Section 6 of the NASA Authorization Act 
of 1968, Public Law 90-67, as amended, 42 U.S.C. 2477, are: 

“The Panel shall review safety studies and operations plans that are referred 
to it and shall make reports thereon, shall advise the Administrator with 
respect to the hazards of proposed operations and with respect to the 
adequacy of proposed or existing safety standards, and shall perform such 
other duties as the Administrator may request.” 

The ASAP consists of nine members appointed to two year terms, reaffirmed annually, by the 
NASA Administrator. The NASA Chief Safety and Mission Assurance Officer participates as 
an ex-officio member in Panel activities. The ASAP meets as a group four times per year, and 
conducts independent fact-finding as needed. 

Given that the ASAP meets only quarterly, and has no full-time investigative staff, the RTF 
TG recognizes that this volume of forward work may be beyond the resources of the ASAP. It 
is possible that ASAP may be assisted by other independent entities to assess the Agency’s 
performance of the tasks described in the subsequent sections. For example, the ASAP could 
make arrangements with the NASA Engineering and Safety Center (NESC), the Independent 
Technical Authority (ITA), the National Research Council, the National Academies, or other 
independent organizations to assist in its evaluations. 

4.1 Conditions for Transition 

It became clear early-on that the ASAP would ultimately become involved with monitoring 
the NASA implementation of the Columbia Accident Investigation Board (CAIB) 
recommendations. The RTF TG was responsible for assessing only the CAIB 
recommendations marked “return to flight,” and the Task Group limited itself to this subset of 
15 items. The remaining 14 (non-return to flight) CAIB recommendations, as well as other 
findings, observations, and NASA “raising the bar” actions would need to be assessed by 
another organization, such as the ASAP. CAIB believed that all 29 of their recommendations 
captured “thinking on what changes are necessary to operate the Shuttle and future spacecraft 
safely in the mid- to long-term.” While the RTF TG, by charter, focused solely on CAIB 
retum-to-flight recommendations, the CAIB report focused more broadly on the needs of the 
Space Shuttle and future program needs. 

As the RTF TG completed their assessments, it also became apparent that some of the retum- 
to-flight implementations contained forward work that would require monitoring by another 
organization, and the RTF TG negotiated a Memorandum of Agreement with the ASAP to 
continue this work. In the case of the retum-to-flight recommendations, the RTF TG only 
assessed those portions of the NASA implementation that was specifically intended for 
STS-114 - any future work was largely outside the scope of the Task Group. The conditions 
that predicated a need to transition a CAIB recommendation to the ASAP were: 

1. A CAIB recommendation had a phased implementation approach, some being 
implemented before return-to-flight and some planned for implementation 
afterwards. For those phases of implementation not planned for STS-114, the 
ASAP will need to monitor and evaluate the future implementation. 
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2. The implementation of a CAIB recommendation will be available for the retum- 
to-flight, but the implementation needs to be demonstrated in the flight 
environment. An example includes the reduction of debris shedding from the 
External Tank. Since the RTF TG completed its assessments prior to STS-114, 
the ASAP will have to assess the results of the flight data to verify the 
performance is as expected. 

3. A CAIB recommendation has a temporary implementation for STS-114 which 
cannot be used on a specific later flight, such as the proposed Hubble servicing 
mission. While the RTF TG has assessed the STS-114 implementation, the 
ASAP will need to monitor and evaluate the final implementation. 


May 17 ,2005 


MEMORANDUM OF AGREEMENT 


Members of dte Return to Flighl (RTF) Ta*k Group and the Aerospace SafeEy Advisory Panel 
t ASAP) met Ort September 14.2fMM, to discus* ideas lo ensure a smooth inm&ilkm between Ihe 
piuwb after the Spate Shuitle returns eq flight. The locus of Ehh trarailion effort was to capture 
knowledge and ensure coniinuily on crilical safely issues us the RIF Task Group colludes. 
Followup activity cm RTF issues and actions wilt be incorporated into the ASAP’s working plan. 

The fotloviing me essential elemenLs of ibc agrcemeivl; 

1. [He RTF Task Group Wilt deliver m final report before return to flight and will 
conclude ils assessment. fad-finding and reporting. 

2. RTF Tusk Group Members wtB continue to he adinini strainely available Lu support 
Ehe AS AP, us requeued. uwi I their charter in lermi naled sometime alter ihe STS- 11 ^ 
launch. 

3. the RTF Task Group Co-Otalts will he available as spokespersons for the Task 
Group. if required, during ihe duration af the return to flighL launch. In oddiEkm. Df- 
Dan Crippcn and Dr, Amy Donahue, who are members of both ihe RTF Task Group 
and ibe ASAP, will have authority lo speak lor the RTF Task Group Oft matters of 
interpretation of ihe RTF Task Group's final report. 

*1, Copies of required RTF Task Group electronic and paper records will be transferred 
10 the ASAP. 

5, After delivery Of the RTF Task Group’ r firml report. RTF Task Group panel leads 

wj (1 meet w ith ASAP members to conduct a Irmtsilion briefing, idcmift ing speei fle 
revs that the ASAP may consider for further obsen^tkm. 


We hel ieve Ihe proposed actions wil I ensure a smooth irtuntfiliwi betw ecn the RTF Task Group 
and the ASAP. 




Thomas P. Siafford 
Lieutenam General. USAF. {Rei 
CoChair, Return lo Flighl Task'Group 




JoFepI W. Dyer 
Vice Admiral. USN, (Rd) 

Chair. Aerospace Safety Advisory Panel 



To assist in the turnover of activities from the RTF TG to the ASAP, several ASAP members 
were invited to observe the final two plenary meetings of the Task Group and witnessed at 
least one Mission Management Team (MMT) simulation. The turnover is also assisted by the 
fact that two Task Group members (Dr. Dan F. Crippen and Dr. Amy K. Donahue) are also 
members of the ASAP. 
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4.2 Items to be Transitioned 

Several of the CAIB retum-to-flight recommendations contain items the RTF TG believes the 
ASAP should continue to monitor. In addition, the Task Group has several items - not related 
to specific recommendations - that it believes require future monitoring or assessment. The 
ASAP might also wish to review the “RTF TG Observation” portion of each assessment. 

4.2.1 Integrated Vehicle 

The STS-114 Operations Integrated Plan for Thermal Protection System Assessment (or 
simply, the OIP) and its Damage Assessment Annex greatly enhanced the ability of the Space 
Shuttle Program to perform an integrated vehicle external damage assessment in support of 
decision-making, primarily within the MMT. The RTF TG believes that NASA should 
continue to develop the OIP and it’s Annex for all future flights, not just for STS-114. The 
information, understanding, and experienced gained from producing the document for 
STS-114 will be invaluable for future mission data integration. The ASAP should monitor the 
continued development of the OIP and its Annex, as well as how the processes and timelines 
described in the documents are used for decision-making within the MMT and other groups. 

4.2.2 CAIB Recommendation 3.2-1, External Tank Debris Shedding 

Debris from the External Tank was the physical cause of the Columbia accident, and NASA 
has gone to tremendous lengths in their attempts to cure the problem. According to the NASA 
May 2005 document The Integrated Risk Assessment Approach for Return to Flight, “... The 
External Tank debris allowable requirements currently do not protect against catastrophic 
damage of the Orbiter Thermal Protection System.” NASA developed a three-phase approach 
to correcting the flaws in the External Tank; Phase 1 was implemented for return-to-flight and 
Phase 3 has been deferred because of the pending 2010 retirement date for the Space Shuttle. 
Phase 2 is currently slated as post-retum-to-flight work, and the RTF TG believes the ASAP 
should closely monitor the implementation of these changes. 

In addition, each of the tanks being used on the first eight launches was substantially 
completed prior to 2003 and has been modified - at least in the details - differently. 
Therefore, each is somewhat unique in its configuration. Although NASA plans to use data 
from the STS-114 flight to further characterize debris from the ET, it is possible that these 
differences will require additional data collection from future missions. 

The RTF TG believes the results of analyses conducted after the STS-114 launch should be 
closely monitored, as well the applicability of any anomalies to the tanks scheduled for future 
missions. The ASAP should continue to track the Program’s efforts to eliminate critical debris 
by aggressively working off the limitations documented in NSTS 60555, Verification 
Limitations for the External Tank Thermal Protection System . 

The Task Group suggests the ASAP monitor the continued use of the labor-intensive thermal 
protection system application processes enacted for the return-to-flight. 

4.2.3 CAIB Recommendation 3.3-1, Reinforced Carbon-Carbon Non-Destructive 
Inspection 

Understanding the condition of the RCC panels used on the Orbiter is essential for safe flight 
operations. NASA has identified future work including finishing the documentation of flight- 
to-flight inspections in the Operations and Maintenance Requirements Document (OMRSD) 
and competing the development of applicable non-destructive inspection standards. 

The RTF TG believes the ASAP should monitor the Agency’s progress toward finishing the 
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documentation, and also ensure that meaningful non-destructive inspections continue for the 
remainder of the Space Shuttle Program. The Task Group is also concerned that NASA has 
only a single ship-set of spare RCC panels in inventory; something made troublesome by the 
long lead-times involved in manufacturing additional panels. 

4.2.4 CAIB Recommendation 3.3-2, Orbiter Hardening 

NASA decided to implement this recommendation in three phases. The first phase of changes 
to the Orbiters has been completed in time for STS-114. The second phase consists of two 
changes which could not be completed in time for the return to flight. They are the completion 
of the remaining “sneak flow” protection changes on RCC panels 1-4 and 14-22, and main 
landing gear door perimeter tile material change. The risk analysis of the tile damage 
tolerance indicated that the main landing gear door is one of the critical areas with which to 
deal. According of the NASA May 2005 document, The Integrated Risk Assessment 
Approach for Return to Flight (p. 11), their “ ... goal was to demonstrate that the capability of 
the Orbiter greater than the expected debris environment; however, we fell short in a number 
of cases.” 

It is important for the ASAP to monitor the progress of the BRI-18 tile material certification 
and the completion of this change on all three Orbiters. The third phase involves more 
extensive changes to the Orbiters, but these are being reconsidered in light of the scheduled 
2010 end of the program. 

Future work that NASA has identified includes continuing the verification of the analytical 
models used in determining the impact resistance of the Orbiter, as well as the continuing 
refinement of the definition for “critical debris.” The RTF TG believes the ASAP should 
monitor the progress of each of these items, with particular attention on model verification 
and configuration management. Abandoning future upgrades to the Orbiter may be 
appropriate given the limited number of missions expected to be flown, but an independent 
assessment of this approach should be carried out. ASAP should review the correlation of the 
remaining risk of damage to potential future Orbiter hardening concepts. 

4.2.5 CAIB Recommendation 3.4-1, Ground-Based Imagery 

Future work that NASA has identified for this recommendation includes the continued 
refurbishment and procurement of imagery assets at the Kennedy Space Center and the 
Eastern Range. The RTF TG believes that the ASAP should continue to assess the availability 
of adequate imagery assets to ensure there are three useful views of the Space Shuttle 
available for all future launches. 

4.2.6 CAIB Recommendation 3.4-2, High-Resolution Images of External Tank 

Future work that NASA identified for this recommendation includes installing additional 
cameras on the External Tank and Solid Rocket Boosters to provide better imagery of the 
Orbiter and its environment during ascent. The RTF TG believes that the ASAP should assess 
the implementation of the ET attach ring and SRB forward skirt cameras, along with the SRB 
solid-state recorders, planned for STS-115 and subsequent flights. 

4.2.7 CAIB Recommendation 3.4-3, High-Resolution Images of Orbiter 

NASA has predicated much of its retum-to-flight planning on conducting detailed inspections 
of the Orbiter once it is on orbit. These inspections are accomplished, for the most part, using 
the Orbiter Boom Sensor System (OBSS) installed in the payload bay and photography from 
the International Space Station. 


Page 122 of 216 



Final Report of the Return to Flight Task Group 


The RTF TG believes that the ASAP should continue to assess what constitutes “adequate 
resolution” as the Orbiter critical damage size evolves. Also, NASA only plans to use the 
OBSS for a limited number of flights; the ASAP should review the plan to discontinue its use 
and ensure that other adequate means exist to acquire the necessary imagery. 

4.2.8 CAIB Recommendation 4.2-1, Solid Rocket Booster Bolt Catcher 

The implementation of this item was straight-forward and has been completed. The RTF TG 
is satisfied that no ASAP involvement is needed. 

4.2.9 CAIB Recommendation 4.2-3, Closeout Inspection 

Ensuring that at least two people observe the final close-out of all Space Shuttle flight 
hardware provided additional assurances that processes were accomplished correctly. The 
NASA implementation of this recommendation seems complete and appropriate. However, 
the RTF TG believes that the ASAP should sponsor periodic monitoring to ensure the process 
is still being followed across the program, particularly as the program winds down. 

4.2.10 CAIB Recommendation 4.2-5, Kennedy Space Center Foreign Object Debris 
Definition 

The implementation of this item was straight-forward and has been completed. The RTF TG 
is satisfied that no ASAP involvement is needed. 

4.2.11 CAIB Recommendation 6.2-1, Consistency with Resources 

The RTF TG believes that NASA should devote continued attention to ensure undue schedule 
pressure does not arise. The Task Group further believes that the ASAP should monitor the 
NASA budget and workforce metrics to ensure sufficient resources are available to meet the 
Space Shuttle mission manifest, especially given the likely resource requirements of the new 
Vision for Space Exploration. 

4.2.12 CAIB Recommendation 6.3-1, Mission Management Team Improvements 

The Task Group believes that the ASAP should observe selected MMT simulations, with 
particular emphasis on team performance and the MMT processes and tools necessary to 
effect integrated time-sensitive critical risk-versus-risk trades and decisions. 

4.2.13 CAIB Recommendation 6.3-2, National Imagery and Mapping Agency 
Memorandum of Agreement 

The implementation of this item was straight-forward and has been completed. The RTF TG 
is satisfied that no ASAP involvement is needed. 

4.2.14 CAIB Recommendation 6.4-1, Thermal Protection System Inspection and 
Repair 

The ASAP should review the development of comprehensive autonomous (independent of 
ISS) inspection and repair capabilities; this is particularly important for non-ISS missions 
(i.e., Hubble Space Telescope Servicing Mission 4), but also protects against the possibility 
than an ISS mission fails to achieve the correct orbit, fails to dock successfully, or is damaged 
during or after undocking. Even for nominal ISS missions, NASA has work remaining in the 
inspection and repair areas; the Task Group believes that the ASAP should closely monitor 
these efforts. With the suspension of CSCS and rescue missions after the first few flights, the 
issue of a certified and operational inspection and repair capability must be addressed. The 
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Task Group feels that the ASAP should make this a high priority when reviewing the Space 
Shuttle Program. 

As the Task Group currently understands the situation, the Space Shuttle Program intends to 
discontinue the use of OBSS three or four flight after STS-114. In the view of the Task 
Group, this would require that other methods of detecting damage - such as the wing leading 
edge sensors - would have to be elevated from “Criticality 3” status to “Criticality 1.” 

The Task Group feels that ASAP should assess progress with respect to selecting, developing, 
and certifying long-term RCC and tile repair capabilities. 

4.2.15 CAIB Recommendation 9.1-1, Detailed Plan for Organizational Change 

While the CAIB did not make specific “cultural” change recommendations (other than three 
specific recommendations to be included in the plan required for R9.1-1), they provided 
numerous pages of text, findings, and observations to underscore their concerns in this area. 
To their credit and in response, over the past 29 months, NASA revised some pre-Columbia 
initiatives and undertook many other new initiatives (both for the Space Shuttle Program and 
NASA wide) to address the CAIB concerns. As the scope of these initiatives were beyond the 
RTF TG charter, the Task Group recommends that ASAP might wish to discern how these 
varied initiatives fit into an integrated senior leadership plan or vision. For the future, it is 
critical that NASA establish a foundation that can carry its vision forward. 

4.2.15.1 CAIB Recommendation 7.5-1 , Independent Technical Authority 

The ASAP should monitor the progress toward completing the establishment of the IT A and 
its Technical Warrant Holders, whether the ITA is working as CAIB intended, whether the 
CAIB organizational concept is workable, and whether the “independent” funding sources are 
working. Additionally, the ASAP should monitor the process by which NASA grants waivers 
to technical requirements to ensure it meets the intent of the CAIB recommendations 

4.2.15.2 CAIB Recommendation 7.5-2 , Safety and Mission Assurance 

ASAP should monitor to ensure SMA continues to be an “independent” voice, and the 
Agency’s alternative implementation of “direct line authority” will require continued ASAP 
oversight. Since the Space Shuttle Program SMA Manager is a voting member on the MMT 
(but does not possess “suspension authority”), further ASAP monitoring might be prudent to 
verify that those Center and SMA Directors with “suspension authority” recognize their 
responsibility and authority and are willing to use it if needed. In addition, ASAP needs to be 
cognizant of the historical trend to diminish the SMA role. Over time, without continued 
Headquarters leadership emphasis on the importance of the SMA role (including Quality 
Assurance), NASA history unfortunately portends that SMA roles become diminished. 

4.2.15.3 CAIB Recommendation 7.5-3 , Systems Engineering and Integration 

The ASAP should assess the progress toward establishing a truly effective Systems 
Engineering and Integration Office. Items remaining include demanding rigorous 
documentation that sustains effective systems integration and engineering, and requiring 
improvements in standards for (and standardization of) validation, verification, and 
certification requirements for the development and use of analytical models. 

4.2.16 CAIB Recommendation 10.3-1, Digitize Closeout Photos 

The implementation of this item was straight-forward and has been completed. However, the 
RTF TG believes that, periodically, the ASAP should evaluate the digital imagery database 
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and closeout photography procedures at the Kennedy Space Center and other NASA 
installations to ensure its continued effectiveness. Should the Shuttle Program be extended 
past 2010, the decision for no further non-critical updates to the drawings should also be 
reconsidered. 

4.2.17 SSP-3, Contingency Shuttle Crew Support 

Because of the risks entailed, and the most-likely negative programmatic effects, the Task 
Group believes that CSCS should never be relied upon to overcome risks that could have been 
mitigated by other actions. The CSCS capability should be used only in the most extreme 
emergency where there is no other viable option for saving the crew of a stricken Orbiter. 

The Task Group believes the ASAP should conduct an independent evaluation of the 
desirability of maintaining a CSCS capability for flights after STS-121. If the capability does 
continue into the future, the ASAP should ensure that it does not become a “crutch” for the 
program and lead to a tendency toward negative changes to the flight rules and operations. 
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Discovery hangs in 
the VAB as it is 
being removed from 
its original External 
Tank in the Vehicle 
Assembly Building at 
KSC. The Orbiter 
was later mated with 
ET-121 prior to the 
launch of STS-114. 
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5 THE RETURN TO FLIGHT TASK GROUP 

On February 1, 2003, the Space Shuttle Columbia disintegrated while returning to Earth 
during the STS-107 mission, killing the crew of seven. Within hours, the independent 
Columbia Accident Investigation Board (CAIB) was appointed to determine the cause of the 
accident. What followed was, perhaps, the most far-reaching accident investigation ever 
conducted. The CAIB released the first volume of their final report on August 26, 2003, 
containing 29 specific recommendations for changes to the vehicle, the Space Shuttle 
Program, and to NASA in general. Among those recommendations were 15 that the accident 
board believed should be implemented prior to returning the Space Shuttle fleet to flight. 

On April 14, 2003, then-N AS A- Administrator Sean 
O’Keefe wrote Lt. Gen. Thomas P. Stafford, U.S. Air 
Force (Ret.), requesting that the Stafford Task Force on 
International Space Station Operational Readiness initiate 
an assessment of NASA’s plans to return the Space 
Shuttle to flight. The Stafford Task Force is a standing 
group chartered by the NASA Advisory Council, an 
independent advisory group to the NASA Administrator. 

One month later Lt. Gen. Stafford responded to the 
Administrator with a plan to activate a sub-organization 
with Col. Richard O. Covey, U.S. Air Force (Ret.), 
leading the day-to-day effort of conducting an 
independent assessment of the 15 CAIB retum-to-flight 
recommendations. As a result, on July 18, 2003, a Return 
to Flight Task Group (RTF TG) was chartered under the 
Federal Advisory Committee Act with Lt. Gen. Stafford and Col. Covey as co-chairs. 

Over the course of the past two years, using expertise from the aerospace industry, federal 
government, academia, and the military, the RTF TG assessed the actions taken by NASA to 
implement the CAIB return-to-flight recommendations. During this time the Task Group 
conducted fact-finding activities, reviewed documentation, held public meetings, reported 
their assessments to the Space Flight Leadership Council, and released three interim reports 
on the progress toward launching the first Space Shuttle mission since the Columbia accident, 
designated STS-114. The assessments of the Task Group, although based primarily on data 
provided by the Space Shuttle Program, are independent of that program and are intended to 
provide the NASA Administrator an evaluation of the progress NASA has made toward 
meeting the intent of the 15 CAIB return-to-flight recommendations. 

As the Task Group delivers this final report to the NASA Administrator, Congress, and the 
American public, we take this opportunity to reemphasize that this report is strictly advisory 
and is not a prerequisite for returning to flight. Only NASA can make the determination if the 
vehicle, supporting infrastructure, and organization are sufficiently robust to resume flying. 

5.1 Federal Advisory Committee Act 

NASA is among several federal agencies that access the insights and experiences of 
accomplished citizens by establishing advisory committees. The Federal Advisory Committee 
Act (FACA - Public Law 92-463 as amended; 5 U.S.C. App. §§1 et seq) governs the creation, 
management, and termination of such advisory committees when they report directly to 
federal officials. The General Services Administration provides government-wide 
administrative guidance for FACA, while the Office of Government Ethics oversees “conflict 
of interest” matters associated with the designation and conduct of advisory committee 
members. 
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For the purposes of the FACA, the RTF TG was composed of two voting Co-Chairs and 
multiple voting members. In addition, the Task Group had one non-voting ex-officio member 
- the NASA Deputy Chief Safety and Mission Assurance Officer. The Executive Secretary of 
the Task Group was a Civil Service employee who performed as the Designated Federal 
Official required by the FACA. 

None of the voting members were NASA employees. However, the Co-Chairs and some 
members were appointed as Special Government Employees under the federal personnel 
system. All members were reimbursed for travel expenses in accordance with normal 
government policy. 

Under the FACA, the members can not have any vested interest in the outcome of the 
assessment. The NASA General Counsel determined that the members of the RTF TG had no 
interest that would prevent them from exercising individual or representative judgment. 

5.2 Purpose and Duties of the Task Group 

The RTF TG was chartered to perform an independent assessment of NASA’s actions to 
implement the CAIB retum-to-flight recommendations. However, this assessment is strictly 
advisory, and NASA remains responsible for the overall safety and operational readiness of 
STS-114 and all subsequent Space Shuttle missions. Perhaps as important as what the Task 
Group was asked to do, is what it was not asked to do: 

1. The Task Group was not asked to pass judgment on the appropriateness or 
validity of the CAIB recommendations. 

2. The Task Group was not asked to pass judgment on the methods chosen by 
NASA to implement the recommendations (i.e., were the selected methods 
the best); we were only asked to assess whether the selected methods met 
the intent of the CAIB recommendation. 

3. Other than assessing the retum-to-flight schedules for “undue pressure,” the 
Task Group was not asked to pass judgment on when the retum-to-flight 
mission should occur. 

To fully understand the intent of the accident board, the RTF TG conducted fact-finding 
interviews with former members and staff from the CAIB. The Task Group did not, however, 
attempt to assess the adequacy or appropriateness of the CAIB recommendations. 

The Task Group has also made several independent observations on safety and operational 
readiness that it believes are appropriate. 

The RTF TG relied on the expertise of its members and other sources to provide this 
assessment. Fact-finding was accomplished using written data and briefings supplied by 
NASA and its contractors, meetings with other persons and organizations as deemed 
appropriate, and site visits to NASA and contractor facilities. In carrying out its 
responsibilities, the Task Group: 

• Focused on the Agency’s actions to implement the 15 CAIB retum-to-flight 
recommendations as related to the safety and operational readiness of STS-114. 

• Used, as it deemed appropriate, the Space Shuttle Program Office and Space 
Shuttle Return to Flight Planning Team, working groups, and supporting 
facilities to conduct the assessment. These included staff advisors, as required, 
for expertise in such areas as engineering, public affairs, law, and security. 
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• Analyzed the facts and opinions considered relevant in the CAIB final report 
and reviewed the supporting documents and databases as needed. 

• Documented and reported RTF TG assessment findings in public meetings, 
three interim reports, and a final report. 

In addition to the 15 retum-to-flight recommendations made by the CAIB, after the April 
2004 plenary meeting the Task Group notified NASA of its intention to assess one additional 
“raising the bar” action that NASA assigned itself as part of its return to flight efforts. This 
task, called SSP-3, Contingency Shuttle Crew Support, is documented in NASA's 
Implementation Plan for the Space Shuttle Return to Flight and Beyond. Essentially, this 
“raising the bar” action addresses the use of the International Space Station as a safe haven for 
a Space Shuttle crew in case an Orbiter is damaged and deemed unsafe for entry. Because of 
the potential for this being a mitigating or supportive capability for return to flight, the Task 
Group felt the need to formally assess NASA’s actions relative to establishing the capability. 

The CAIB had indicated that NASA need only develop a detailed plan to change certain 
aspects of its organization prior to retum-to-flight. However, because the return-to-flight 
activities have taken much longer than the CAIB anticipated, NASA has had the opportunity 
to begin implementing the planned reorganization. Therefore, in addition to R9.1-1 (which the 
CAIB marked as a return-to-flight item), the Task Group is assessing the progress made on 
the three organizational recommendations (R7.5-1, R7.5-2, and R7.5-3). These three CAIB 
recommendations are assessed within the context of the R9.1-1 planning recommendation and 
may be found in that section of this report. 

Aside from the one non-CAIB-recommendation noted above, the RTF TG did not assess any 
other Space Shuttle Program hardware, software, processes, organizations, or procedures. For 
instance, the Task Group did not evaluate the readiness or safety of the Space Shuttle Main 
Engines, Solid Rocket Boosters, auxiliary power units, fuel cells, or other element hardware. 
Nor did the Task Group assess the PASS or BFS flight software. It is NASA, and NASA 
alone, that can adequately evaluate the Space Shuttle Program as a whole and determine its 
readiness to resume flying. 

5.3 Organization of the Task Group 

The RTF TG membership consisted of select representatives from the Stafford Task Force on 
International Space Station Operational Readiness, under which it was chartered, and 
additional members selected by the Co-Chairs and appointed by the NASA Administrator. 
These members provided a knowledge base appropriate to the assessment of NASA’s 
implementation of the CAIB retum-to-flight recommendations. 

After reviewing the nature of the CAIB recommendations, the RTF TG organized itself into 
three panels: the Management Panel, Operations Panel, and Technical Panel. Subsequently, an 
Integrated Vehicle Assessment Sub-Panel and Editorial Sub-Panel were established for 
specific tasks. Each of the Panels was responsible for leading the assessment of specific CAIB 
recommendations, and prepared a final presentation for the assembled Task Group to detail 
NASA’s implementation of each recommendation in preparation for the final deliberations 
and vote. 
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5.3.1 Management Panel 

The Management Panel focused on the NASA compliance with the CAIB recommendations 
concerning Space Shuttle Program management, the retum-to-flight integrated schedule, 
program/project risk management, and public safety policy. This assessment included CAIB 
recommendations: 

R6.2-1 Consistency with Resources 

R6.3-1 Mission Management Team Improvements 

R6.3-2 National Imaging and Mapping Agency Memorandum of Agreement 
R9.1 -1 Detailed Plan for Organizational Change, including: 

R7.5 -1 Independent Technical Engineering Authority 
R7.5-2 Safety and Mission Assurance Organization 
R7.5-3 Space Shuttle Integration Office Reorganization 

5.3.2 Operations Panel 

The Operations Panel focused on the NASA compliance with the CAIB findings and 
recommendations concerning Space Shuttle Program crew and controller operations, 
processing and launch operations, and procedures to support operations. This assessment 
included CAIB Recommendations: 

R3.4-1 Ground-Based Imagery 

R3.4-2 High-Resolution Images of External Tank 

R3.4-3 High-Resolution Images of Orbiter 

R4.2-5 Kennedy Space Center Foreign Object Debris Definition 

R6.4-1 Thermal Protection System Inspection and Repair (operations only) 

R10.3-1 Digitize Closeout Photos 

SSP-3 Space Shuttle Program Action - Contingency Shuttle Crew Support 

5.3.3 Technical Panel 

The Technical Panel focused on the NASA compliance with the CAIB recommendations 
concerning the material condition of the Space Shuttle. This included the development of and 
compliance with technical requirements, vehicle engineering, hardware and software 
development/verification, and overall vehicle certification status. This assessment included 
CAIB recommendations: 
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R3.2-1 External Tank Debris Shedding 

R3.3 -1 Reinforced Carbon-Carbon Non-Destructive Inspection 
R3.3-2 Orbiter Hardening 
R4.2-1 Solid Rocket Booster Bolt Catcher 
R4.2-3 Closeout Inspection 

R6.4-1 Thermal Protection System Inspection and Repair (system hardware 
development only) 

5.3.4 Integrated Vehicle Assessment Sub-Panel 

The Integrated Vehicle Assessment Sub-Panel combined insights from the Management, 
Operations, and Technical Panels to assess the ability of NASA to perform an integrated 
vehicle external damage assessment, based on a variety of imagery and sensor sources in 
support of decision-making during launch and flight. 

This sub-panel focused on cross-cutting vehicle assessment actions, specifically including an 
assessment of the Orbiter Thermal Protection System. The sub-panel assessment considered 
the broad interactions of allowable debris, critical damage size, damage detection and 
assessment via imagery and sensors, as well as the development of the Mission Management 
Team improvements needed to support real-time operations. This assessment included CAIB 
recommendations: 

R3.2-1 External Tank Debris Shedding 

R3.3 -2 Orbiter Hardening 

R3.4-1 Ground-Based Imagery 

R3.4-2 High-Resolution Images of External Tank 

R3.4-3 High-Resolution Images of Orbiter 

R6.3-2 National Imaging and Mapping Agency Memorandum of Agreement 
R6.4-1 Thermal Protection System Inspection and Repair (integrated data flow 
only) 

R6.3-1 Mission Management Team Improvements 

SSP-3 Space Shuttle Program Action - Contingency Shuttle Crew Support 

5.3.5 Editorial Sub-Panel 

The Editorial Sub-Panel coordinated the preparation of the RTF TG interim and final reports. 

5.3.6 Staff and Other Personnel 

The Task Group maintained offices outside the Johnson Space Center in Houston, Texas, for 
use by the permanent staff and visiting members. The members generally worked out of their 
home offices except when on fact-finding trips or attending Task Group plenary and public 
meetings. 

The Executive Secretary performed as the Designated Federal Official (DFO) per FAC A 
regulations by fulfilling all functions required by statute, including recordkeeping and 
compliance with FACA procedures. The DFO served as the Government’s agent for all 
matters related to RTF TG activities. 

Support personnel facilitated the Task Group fact-finding activities and were assigned to each 
panel and sub-panel. A NASA General Counsel was provided by the Johnson Space Center 
and was available for legal advice and interpretations concerning technical and programmatic 
issues relevant to the NASA implementation of the CAIB findings and recommendations. A 
NASA Public Affairs Officer from the Marshall Space Flight Center provided support to the 
Task Group and served as an interface with the news media and the public. Specialists, 


Page 131 of 216 



Final Report of the Return to Flight Task Group 


contractors, consultants, and other personnel were provided to the RTF TG as needed during 
its assessment activities. Administrative, travel, and secretarial support was provided at the 
Houston office. Valador, Inc., of Herndon, Virginia, was retained as the Task Group support- 
contractor to provide consultants, maintain the RTF TG web site, and other duties as needed. 

5.3.7 Personnel Changes 

As with any group that operates over a long period of time, personnel changes on the RTF TG 
were inevitable. In June 2003, as the Task Group was initially being organized, there were 20 
members of the Task Group; all except the ex-officio were voting members: 

Lt. Gen. Thomas P. Stafford, U.S. Air Force (Ret.), Co-Chair 
Col. Richard O. Covey, U.S. Air Force (Ret.), Co-Chair 
Col. James C. Adamson, U.S. Army (Ret.) 

Maj. Gen. William A. Anders, U.S. Air Force Reserve (Ret.) 

RADM Walter H. Cantrell, U.S. Navy (Ret.) 

Mr. Benjamin A. Cosgrove 
Dr. Dan L. Crippen 
Mr. Joseph W. Cuzzupoli 
Dr. Charles C. Daniel 
Dr. Richard Danzig 

Gen. Ronald R. Fogleman, U.S. Air Force (Ret.) 

Col. Gary S. Geyer, U.S. Air Force (Ret.) 

Maj. Gen. Ralph H. Jacobson, U.S. Air Force (Ret.) 

Mr. Richard H. Kohrs 

Mr. James D. Lloyd, ex-officio 

Lt. Gen. Forrest C. McCartney, U.S. Air Force (Ret.) 

Mr. David Raspet 
Mr. Seymour Z. Rubenstein 
Mr. Robert B. Sieck 
Mr. William Wegner 

By the end of July 2003, seven additional voting members who brought specific expertise had 
been added to the Task Group: 

Dr. Walter D. Broadnax 
Dr. Kathryn I. Clark 
Dr. Amy K. Donahue 
Ms. Susan M. Livingstone 
Dr. Rosemary O’Leary 
Dr. Decatur B. Rogers 
Mr. Thomas N. Tate 

On September 12, 2003, it was announced that three new voting members had been added to 
the Task Group, bringing the total to 29 voting members and 1 ex-officio. 

Ms. Christine H. Fox 

Col. Susan J. Helms, U.S. Air Force 

Dr. Kathryn C. Thornton 

However, later during September 2003, two members resigned from the Task Group for 
personal reasons: 

Maj. Gen. Ralph H. Jacobson, U.S. Air Force (Ret.) 

Mr. David Raspet 
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Since the Task Group still had a sufficiently broad cross-section of necessary skills, these 
members were not replaced. At this time, Dr. Dan L. Crippen took the Lead of the 
Management Panel formerly held by Maj. Gen. Jacobson. 

On May 3, 2004, NASA Headquarters reassigned the Task Group Executive Secretary, Mr. 
David Lengyel, to the Office of the Chief Engineer at Headquarters because it was felt his 
skills and expertise were needed in that office. Mr. Vincent D. Watkins, from the Johnson 
Space Center, succeeded him as Executive Secretary. 

In June 2004, RADM Walter H. Cantrell, U.S. Navy (Ret.) left the Task Group to become 
Deputy Chief Engineer for NASA’s new Independent Technical Authority. Since the Co- 
Chairs felt that the Task Group still had sufficient membership, no successor was named for 
RADM Cantrell. Dr. Charles Daniel replaced RADM Cantrell on the Integrated Vehicle 
Assessment Sub-Panel and Editorial Sub-Panel. 

In September 2004, Dr. Richard Danzig left the Task Group because “the press of other 
activities involving national security problems has left me without time to perform as a 
member of the Group.” Since the Task Group believed it was close to completing its 
activities, no successor was selected. 

The first representative from the Astronaut Office, Lt. Col. Carlos L. Noriega, U.S. Marine 
Corps (Ret.), left the Task Group after he received a flight assignment on STS-121 in 
December, 2003. Lt. Col. Noriega is currently the Manager of the Exploration Systems 
Engineering Office at the Johnson Space Center. He was replaced on the Task Group by Col. 
Michael J. Bloomfield, U.S. Air Force. 

Participation of at least 51 percent of the voting members was required to constitute a quorum 
of the Task Group. 

5.4 Relationship to the NASA Implementation Plan 

At the same time that the CAIB was conducting its investigation, NASA began pursuing an 
Agency-wide effort to improve human space flight. Part of this effort was taking a fresh look 
at all aspects of the Space Shuttle Program, from technical requirements to managerial 
processes. The outcome was a set of NASA-generated actions that complement the CAIB 
recommendations. These are documented in NASA’s Implementation Plan for Space Shuttle 
Return to Flight and Beyond. (For brevity, the RTF TG generally called this the NASA 
Implementation Plan.) 

The NASA Implementation Plan integrates both the 
CAIB recommendations and NASA-generated actions 
into a single document. Many of the NASA-generated 
actions “raise the bar” beyond what the CAIB 
recommended. With a single exception, the RTF TG 
did not assess these raising-the-bar actions - that 
exception is SSP-3, Contingency Shuttle Crew Support. 

It should be noted that some of the raise-the-bar items 
in the NASA Implementation Plan overlapped various 
CAIB requirements, but the RTF TG assessed the 
CAIB requirements as written. 

In general, the NASA Implementation Plan provides 
high-level description of the steps taken by NASA to 
implement the CAIB recommendations and the NASA¬ 
generated actions. The implementation plan is revised 
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periodically, with the latest version being the Tenth Edition on June 3, 2005. The NASA 
Implementation Plan went from its December 3, 2004, “Revision C” to the March 18, 2005, 
“Ninth Edition.” This was explained to the Task Group as an attempt to correct the previous 
system of revisions that did not track intermediate releases (e.g., 1.1); there had been eight 
releases prior to March 2005, so this version was called the Ninth Edition. 

The RTF TG has not independently verified or validated any information contained in NASA ’s 
Implementation Plan for Space Shuttle Return to Flight and Beyond. 

5.5 Conduct of the Assessment 

The diverse nature of the CAIB recommendations required a unique approach to the 
assessment of each item. This was a result of the presence of process enhancements, hardware 
modifications, organizational changes, and documentation revisions, often in a single item. In 
general, the lead panel conducted fact-finding through field trips to relevant sites, meetings 
with NASA personnel, discussions with contractors, issuing formal Requests for Information 
(RFI) to NASA, and consultations with other experts. 

5.5.1 Coordination with NASA 

NASA provided primary points-of-contact to manage the flow of information between the 
Task Group and the NASA community. Requests for fact-finding meetings, supporting data 
via Requests for Information (detailed in the next section) and coordination of schedules and 
product deliveries was filtered through these contacts. These NASA representatives also 
developed and provided the official input to the RTF TG for each recommendation in a 
closure package (this process is discussed further in Section 6.6). Meetings between NASA 
and the Task Group included formal briefings directly to the members and those where Task 
Group members were simply part of the audience of a regularly-scheduled meeting. 

All material provided to the RTF TG became a part of the permanent Task Group record. 
Some of this material will not be made available to the public because it contains data 
restricted under the International Traffic in Arms Regulations (ITAR, 22 CFR Parts 120-130) 
or company-proprietary information that the contractors have a right to protect under their 
existing agreements with NASA. All data not restricted by security, ITAR, or company- 
proprietary considerations were entered into the Process-Based Mission Assurance (PBMA) 
database to facilitate sharing among Task Group personnel. These data will be archived at the 
National Archives and Records Administration. 

5.5.2 Requests for Information 

The primary means of requesting and transmitting information between the Program Office 
and the Task Group was called a “Request for Information” form. This process was similar to 
that used by the CAIB to request data. An RFI could be a simple request for existing facts or a 
complex inquiry on operations. In response to an RFI, NASA could provide information, or 
make specific make presentations to the Task Group. The RTF TG intended that all RFIs be 
completed prior to final deliberations on individual retum-to-flight recommendation 
assessments. 

When a Task Group member needed information, the member or staff completed an RFI 
form. This form detailed the information required, along with a date by which the information 
was needed. After the RFI was approved by the appropriate Panel Fead, it was logged into an 
RTF TG database. The RFI was then sent to the NASA point-of-contact via the NASA 
representative to the RTG TG. The NASA point-of-contact had the authority to accept or 
reject the RFI. Rejection was usually caused by the RFI being too broad and placing too great 
a burden on the NASA organization that was already working to implement the required 
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retum-to-flight changes. If the NASA point-of-contact rejected an RFI, they worked with the 
Task Group member to revise the request, which was then resubmitted through the process. 
Once the NASA point-of-contact accepted the RFI, the request was transferred to the 
appropriate NASA organization. This information was then fed back to the RTF TG staff to 
update the tracking database. 

The assigned NASA organization developed a response that was then reviewed and approved 
by a process within NASA. A response to an RFI was only considered official when it was 
signed by designated officials of the Space Shuttle Program Office. At this point, the NASA 
point-of-contact sent the data to the RTF TG. If the information was deemed acceptable, the 
NASA point-of-contact and the RTF TG Panel Lead signed the RFI form for official closure. 
The RFI form and associated response was then uploaded into PBMA and the RTF TG 
tracking database was updated. 



5.6 Assessment Closure Process 

While the Task Group was conducting fact-finding activities, NASA was developing and 
implementing plans to satisfy the CAIB recommendations. When NASA was satisfied with its 
implementation, the Agency presented a Return to Flight Action Closure Package and its 
supporting documentation to the Task Group. These were auditable documents that chronicled 
NASA’s implementation of each CAIB return-to-flight recommendation. Each Return to 
Flight Action Closure Package contained, at a minimum, the following elements: 
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1. Signature sheet, including: 

a. Relevant element or project manager(s) 

b. Space Shuttle Program Manager 

c. Deputy Associate Administrator for International Space Station and 
Space Shuttle Programs 

d. Chief Safety and Mission Assurance Officer 

e. Space Flight Leadership Council Co-Chairs 

2. Transmittal letter from the Space Flight Leadership Council Co-Chairs to the RTF 
TG Co-Chairs 

3. Executive Summary, including: 

a. Background information (including assumptions and interpretation of 
the CAIB recommendation) 

b. Corrective measures and results 

c. Open issues 

d. Verification 

4. Presentation package for the RTF TG (including back-up charts) 

During the plenary meeting in April 2004, the Task Group had the opportunity to exercise this 
process for the first time. Although deemed generally successful, the process was further 
refined with the following changes: 

1. The definition of tasks, requirements, and results would be developed from the most 
recent release of the NASA Implementation Plan. 

2. The metrics and audit trail specified above would include the use of the current 
Space Shuttle Program Office configuration management system to provide tracking 
on any required: 

a. Test plans, results and reports 

b. Design data and documentation 

c. Programmatic documentation, including Directives, Actions, and 
Change Requests 

d. Documentation and documentation traceability, starting with the 
programmatic documentation, NSTS 07700 

e. Detailed audit trail and plan for these activities, but not the completion 
of activities prior to submittal for approval 

3. Agreements on the appropriate level at which to track, verify, and certify the 
activities to be included in the closure package. 

After being received, the Return to Flight Action Closure Package was evaluated by the 
appropriate RTF TG Panel(s). When the Panel(s) was satisfied that the package was complete, 
it reported to the full Task Group. While the presentation by NASA to the Panel was usually 
by teleconference, the Panel’s reporting to the full Task Group could be either by 
teleconference or during a face-to-face plenary. The process was the same regardless of the 
forum. 

At the conclusion of the deliberations, the RTF TG formally notified the Space Flight 
Leadership Council of the Task Group’s determination via correspondence; the assessment 
could be considered “closed” or “conditionally closed,” or it could remain open. If an 
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assessment was “conditionally closed,” the Task Group identified in the same correspondence 
what action or documentation was required for full closure. 

As the Task Group completed its activities, however, it was eventually recognized that this 
nomenclature was misleading. Both NASA and the press had interpreted the term “closed” as 
applying to the recommendation itself; the Task Group had no power, nor intent, to “close” a 
CAIB recommendation. Rather, it was the assessment being conducted by the Task Group 
that was either “open” or “closed.” In this context, “closed” meant that the Task Group’s 
assessment was complete. 

Although the three interim reports used different terminology, this final report uses a more 
appropriate nomenclature. By definition, all the Task Group’s assessments are now “closed” 
since the RTF TG has disbanded at the end of its charter. In each case, the determination is 
that the NASA implementation met the intent of the CAIB recommendation or that it did not 
meet the intent. 

5.7 Summary of Interim Reports 

The first two interim reports were prepared by the Editorial Sub-Panel, consisting of Dr. Dan 
Crippen, RADM Walt Cantrell, and Dr. Rosemary O’Leary. For the third interim report, 
RADM Cantrell was replaced by Dr. Charles Daniel. The Technical, Management, and 
Operations panels provided the primary substance of the reports. The reports were submitted 
for comments to the entire Task Group, and to NASA for technical review only. Co-Chair 
Col. Richard Covey approved the final version of each interim report prior to its release. 

The first interim report was released on January 20, 2004. This report presented the 
assessment status of each CAIB retum-to-flight recommendation as of early 2004. All of the 
assessments were still open at this point in time. 

The second interim report was released on May 19, 2004, and it updated the assessment status 
of each recommendation. NASA had submitted closure packages for R3.3-1, R4.2-3, and 
R6.3-2, and the Task Group’s assessments of these recommendations were conditionally 
closed. The Task Group felt that there had been substantial progress across the board relative 
to all of the return-to-flight recommendations. To support this conclusion, the second interim 
report noted that several other recommendations were far enough along that the assessments 
could likely be closed at an anticipated August plenary. 

The third interim report was released on January 28, 2005, and it again updated the 
assessment status of each recommendation. The report noted that the assessment of R3.3-1, 
which had been conditionally closed in the second interim report, had not changed status. 
NASA had submitted five new closure packages, resulting in the assessments of R3.4-2, 
R4.2-1, R4.2-5, and R10.3-1 being fully closed and R3.4-1 being conditionally closed. NASA 
supplied additional data for R4.2-3 and R6.3-2, which had been conditionally closed in the 
second interim report, so the Task Group revised the status of its assessment in these cases to 
fully closed. 

At the conclusion of its final plenary meeting on June 27, 2005, the Task Group delivered a 
copy of the Executive Summary only to the NASA Administrator, and copies were 
transmitted to Congress and the White House. The Executive Summary was also posted to the 
Task Group’s web site for public distribution. The Executive Summary contained at the 
beginning of this Final Report is a slightly edited revision of the version released on July 27 - 
the edits were minor in nature and did not change the content. 
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6 SUMMARY OF THE RTF TG PLENARY MEETINGS 

Over the course of two years, the Return to Flight Task Group held 11 plenary meetings to 
discuss its assessment of NASA’s implementation of the Columbia Accident Investigation 
Board (CAIB) return-to-flight recommendations. Nine of these meetings were conducted 
face-to-face, and two were via teleconference. All of these included fact-finding sessions 
among the members, and eight included public meetings to deliberate results. The minutes of 
the public meetings are public record , and video and/or audio of the meetings is available on 
the RTF TG website. 

Three of the following summaries were previously published in the interim reports that were 
issued immediately after the meetings, and are provided here mostly verbatim (only minor 
editorial corrections). For that reason, they are written in the present tense, even though the 
events they discuss are long past. All of these descriptions discuss the events as they were 
presented at the time; many things have changed over the course of the Task Group’s work 
and the descriptions presented here do not necessarily reflect the current or final status. 

6.1 Summary of August 2003 Plenary 

This plenary was held August 5-7, 2003, at the Kennedy Space Center, Florida. This meeting 
was largely administrative in nature as the Task Group received briefings and developed 
operating procedures, plans, and schedules. During fact-finding, the Task Group received 
briefings from the Space Shuttle Program regarding its organization, vehicle processing, and 
the Certificate of Flight Readiness (CoFR) process. The Task Group received a presentation 
on the coatings used on the launch pad structures and their effects on the reinforced carbon- 
carbon wing leading edge. NASA also provided a briefing on ascent imagery and 
the Agency’s preliminary plans regarding how to implement the CAIB imagery 
recommendations. The Space Shuttle Program Manager and his staff made a presentation 
explaining the purpose and scope of NASA’s Implementation Plan for Space Shuttle Return to 
Flight and Beyond [Revision 1 was current when this plenary was held] and NASA’s current 
schedule for implementing the CAIB recommendations. Following the fact-finding, the Task 
Group held its first public meeting. This event was covered by the news media and the Task 
Group introduced itself and discussed its roles and responsibilities. 



From the beginning, 
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6.2 Summary of September 2003 Plenary 

This plenary was held September 9-11, 2003, in Houston, Texas. Again, this fact-finding 
meeting was partly administrative in nature, with the members receiving a briefing on the 
Freedom of Information Act (FOIA) and a presentation by the NASA Inspector General. In 
addition, NASA briefed the Task Group on the current status of NASA’s Implementation Plan 
for Space Shuttle Return to Flight and Beyond [Revision 1.1 was current when this plenary 
was held], and a discussion of each CAIB return-to-flight recommendation followed. NASA 
officials then provided a top-level overview of the approach they were using for retum-to- 
flight planning. The core objective was to eliminate critical debris from the External Tank, 
with a long-term goal of eliminating all debris. Additional efforts centered on imagery, 
inspection, and repair. The Task Group also discussed the roles and responsibilities of the 
three panels along with which assessment each panel would lead. Splinter fact-finding 
meetings dedicated to each panel occupied the remainder of the plenary. Since there were no 
items to deliberate, the Task Group did not hold a public meeting. However, members of the 
media were briefed during a teleconference. 

6.3 Summary of December 2003 Plenary 

This plenary was held December 9-11, 2003, in Houston, Texas. This meeting began, in 
earnest, the long road to assessing NASA’s implementation of the CAIB return-to-flight 
recommendations. 

The CAIB uncovered some very specific conditions that led to the demise of the Columbia 
along with process and management failures that contributed to the accident. In a sense, the 
loss of the Columbia was caused primarily by two faulty assumptions: 

Foam shed from the External Tank would be “transported” around the leading edge 
of the wing by the aerodynamics of the Orbiter; and, 

The foam was not substantial enough to develop a ballistic moment capable of 
puncturing the reinforced carbon-carbon on the wing leading edge. 


Return to Flight Task 
Group members 
participate in fact¬ 
finding meeting in 
Houston September 
10, 2003. 
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It turns out that both assumptions - long-held and widely shared within NASA - were wrong, 
despite previous launches in which foam was shed and little damage was done, seemingly 
validating the assumptions. Thus, the “conditioned” response of senior managers to more 
junior members, who questioned these assumptions after the Columbia launched, was one of 
discouraging dissent and of comfort with established technical and operational assumption. 
The problem was exacerbated by systemic failures that prevented critical information getting 
to the right people at the right time. 

In this light, the technical and operational challenges for NASA are to rectify the 
consequences of these faulty assumptions by, for example, removing debris sources, 
enhancing photography, improving on-orbit inspections, and developing on-orbit Thermal 
Protection System repair. The primary challenge for the Agency’s management is to devise an 
organization with embedded processes to identify other faulty assumptions. 

The Return to Flight Task Group is charged with assessing the implementation of the CAIB 
recommendations. The RTF TG is not in the business of suggesting specific remedies. As one 
member put it, the Task Group is in the position of an umpire calling balls and strikes in a 
zone defined by the CAIB recommendations. The RTF TG is not in the position of evaluating 
the overall readiness or safety of the next flight, just the implementation of the CAIB return- 
to-flight recommendations. 

Because of the substantial changes to the foam insulation and inspection techniques for the 
External Tank, and the current lack of understanding of the foam shedding phenomena, the 
STS-114 ascent must be considered a test flight. As such, the RTF TG expects NASA to 
capture as much test data as possible during ascent, particularly in regard to the imaging 
recommendations of the CAIB. 

NASA has responded to all the recommendations the CAIB identified as necessary for 
accomplishment before the next Space Shuttle flight in NASA’s Implementation Plan for 
Space Shuttle Return to Flight and Beyond [Revision 1.1 was current when this plenary was 
held]. Not surprisingly, progress on the many recommendations has been uneven. Several of 
the technical responses to specific recommendations have indicated substantial progress, 
although none have been completed. Others, such as preparation of a detailed plan for the 
implementation of an Independent Technical Authority, are still in planning and some time 
away from implementation and a long time away from evaluation. 

While the tone of this interim report is justifiably positive, progress should not be mistaken 
for accomplishment. As time passes and the next scheduled flight approaches, the enormity of 
the remaining task looms. Detailed plans for many of the recommendations have not been 
forthcoming. NASA has not been timely in some of its responses to Task Group requests for 
information. And while some of the most critical organizational issues raised by the CAIB 
require only a “detailed plan” before return-to-flight, the RTF TG will be looking for plans 
and processes that will stand the test of time - not just suffice for the first launch - much as 
the hardware redesigns are expected to serve the life of the Space Shuttle. It is still much too 
soon to predict either the success of implementation or the timing of the next flight. 

A public meeting was held after this plenary and members of the media were briefed during a 
press conference. 

6.4 Summary of April 2004 Plenary 

This plenary was held April 12-16, 2004, in Houston, Texas. There had been several changes 
in NASA’s return to flight effort since the previous plenary meeting in December 2003. First, 
and most immediately, the schedule for the next launch was moved from September 2004 to 
March-April 2005. This schedule change was prompted by three developments: 
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1. Additional testing of the susceptibility of the Orbiter Thermal Protection System 
to damage, especially the reinforced carbon-carbon, coupled with advanced 
analysis of the airflows around the Orbiter, External Tank, and Solid Rocket 
Boosters, indicated that the foam on a larger area of the ET should be 
reassessed; 

2. Several rudder speed brake actuators were discovered to have been incorrectly 
assembled during the original manufacture over 20 years ago. Further, the gears 
in the actuators have generally suffered minor damage with use and time. 
Therefore, all the actuators are being replaced or refurbished; and 

3. Delays in the design and manufacture of a new camera/laser boom that will be 
used by the Orbiter’s robotic arm to inspect for possible damage while on orbit. 

This change in schedule means that NASA will have additional time to implement the CAIB 
recommendations before return to flight. In many cases this change also allows expected 
plans to be at least partially implemented. For example, the CAIB called for a detailed plan to, 
among other things, establish an Independent Technical Authority. It is expected that plan will 
now be implemented, at least for the Space Operations Mission Directorate [called the Office 
of Space Flight at the time], before next year. 

The expanded period before the next launch also allows NASA additional time to select and 
perfect methods to implement technical solutions, such as inspecting the Orbiter Thermal 
Protection System for damage. Since the loss of Columbia , NASA has been engaged in a 
wide-ranging search for corrective and preventive measures of all types. In some cases, the 
time is approaching when decisions must be made as to the most promising alternatives and 
resources focused on this smaller set of possibilities - the garden must be thinned. In this 
sense, the additional time until launch can be seductive and leadership will need to be 
exercised to sort the many options under consideration. 

The second major change since December is the announcement of President Bush’s vision for 
the future of space exploration, particularly the human space flight component. The President 
proposed to use the Space Shuttle to complete the construction of the International Space 
Station and then retire the Space Shuttle no later than 2010. In its place would be continued 
reliance on international partners to service the International Space Station as well as the 
possibility of private sector development of launch vehicles. During the next decade, NASA 
would also begin to develop the capability to return astronauts to the moon, establish a lunar 
presence, and begin the efforts to explore Mars. 

While the President’s vision has obvious implications for the long-term use of the Space 
Shuttle, its effects on the current efforts have not been fully examined. However, no matter 
how long the Space Shuttle is used, it must first be safely returned to flight. Therefore, except 
for potential competition for human and financial resources, the new program should have 
minimal impact on the actual return to flight activities and the implementation of CAIB 
recommendations. 

Third, the Task Group determined that the contingency of using the International Space 
Station as a safe haven in the event of potentially catastrophic vehicle damage is becoming 
increasingly important in NASA’s decision-making for return to flight. Therefore, the Task 
Group formally notified NASA of its intent to assess the Contingency Shuttle Crew Support 
capability (“raising the bar” action SSP-3 in the NASA Implementation Plan) much as if it 
were a CAIB recommendation. 

The Task Group is encouraged by NASA’s progress since its last plenary in December 2003. 
Throughout the organization, the people of NASA are engaged and dedicated to correcting the 
deficiencies that led to the demise of Columbia. 
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The RTF TG is conditionally closing its assessment of three CAIB recommendations. 
“Closing” an assessment means that NASA provided sufficient information concerning 
the Agency’s implementation of a specific CAIB retum-to-flight recommendation; 
“conditionally” means that closing is dependent on the delivery of final documentation. The 
three assessments being conditionally closed with this second interim report are: R3.3-1, 
Reinforced Carbon-Carbon Non-Destructive Inspection; R4.2-3, Closeout Inspection; and 
R6.3-2, National Imagery and Mapping Agency Memorandum of Agreement. The Task 
Group will continue to monitor the implementation of these recommendations, and NASA has 
agreed to notify the Task Group if there is any material change in status. 

There has been progress on virtually all of the 12 remaining retum-to-flight recommendations. 
It is anticipated that several more recommendations will be substantially met by the time of 
the next RTF TG plenary in the summer. 

One universal concern of the Task Group is the personnel requirements to meet the CAIB 
recommendations and other retum-to-flight activities. The various new organizations, such as 
the NASA Engineering and Safety Center, the Independent Technical Authority, and the 
System Engineering and Integration Office, all require talented staff drawn largely from the 
current NASA and contractor pool. At some point, the ability of the Space Shuttle Program to 
carry out its mission may be hampered by personnel shortages. 

The most important work remains efforts to eliminate critical ascent debris. If it could be 
guaranteed that no critical debris would come from the External Tank, the immediate cause of 
the loss of Columbia would be rectified. But such a guarantee is impossible short of extensive 
flight testing. Analyses and simulation will allow a level of comfort before launch, and 
advances in non-destmctive inspection techniques may add to confidence. However, 
statistically significant results verifying ET debris conditions may not be accomplished even 
by the end of the Space Shuttle Program. 

As such, on-orbit inspection and repair remain necessary to reduce the risk to future flights. 
Should one or both of these capabilities not be fully developed by the anticipated date of 
return to flight, the ability for the crew to await a rescue mission at the International Space 
Station will become an important consideration for the next launch. 

A public meeting was held after this plenary and members of the media were briefed during a 
press conference. 

6.5 Summary of July 2004 Plenary 

This plenary was held on July 22, 2004, by teleconference since scheduling issues prevented 
the members from gathering in a common location. Final fact-finding activities were 
conducted via fax, email, and telephone prior to the public meeting. The public meeting was 
primarily to deliberate closing two Task Group assessments: R4.2-5, KSC Foreign Object 
Debris Definition, and R10.3-1, Digitize Closeout Photos. 

NASA had submitted closure packages for these recommendations on June 15 (R10.3-1) and 
July 15 (R4.2-5), and the Task Group evaluated the closure packages and conducted fact¬ 
finding to verify the status of each recommendation. After deliberating, the Task Group voted 
to conditionally close its assessment of each recommendation pending the delivery of final 
data from NASA. In each case, the Task Group felt the Agency met the intent of the CAIB. 

6.6 Summary of September 2004 Plenary 

This plenary was held September 14-16, 2004, in Houston, Texas. Even before the plenary 
convened, the public meeting scheduled for September 16, 2004, was postponed. Several 
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members of the Task Group lived in the path of Hurricane Ivan and needed to secure their 
property. Nevertheless, available members of the Task Group met to continue their fact¬ 
finding activities. There were no assessments being considered for closure during the planned 
meeting. 

During fact-finding, Lt. Gen. Stafford reviewed the previous week’s Congressional testimony 
by himself and NASA Administrator Sean O’Keefe. Afterwards, there was a brief discussion 
of the hurricane damage to the Kennedy Space Center and the possible impacts on retum-to- 
flight. At this point the Agency was still expecting a March 2005 launch of STS-114, and 
believed that data for most, if not all, of the open assessments would be provided in time for 
the December 2004 plenary. NASA explained that the events for retum-to-flight were 
“milestone driven,” not “schedule driven.” 

An apparent change within NASA was discussed, in which the Agency seemed to be choosing 
a “best effort” path instead of the more formal certification process. Several members of the 
Task Group expressed their opinion that NASA should continue the certification process 
instead of reverting to the less rigorous best effort concept. This plenary was where the Space 
Shuttle Program first introduced the “capability over environment” (C/E) concept to the Task 
Group. A long discussion followed about Recommendation R6.4-1, Thermal Protection 
System Inspection and Repair, attempting to better understand the intent of the CAIB. 

Behavioral Science Technology, Inc. (BST) presented a status of its study of the Agency’s 
cultural change initiative. Representatives from BST previewed their conclusions: NASA 
leadership is committed to making changes in the culture; the safety climate remains very 
strong; the process has begun on the harder, longer-term job of changing the culture; and if 
present activities and trends continue, it is likely that NASA will be successful in 
transforming its culture. BST cautioned, however, that while the commitment is strong at the 
Space Flight Leadership Council level, it seems less so at the program management level. 
BST described an important distinction between culture and climate. Culture comprises the 
common values that drive organizational performance; it is deeply embedded and changes 
slowly. Climate is much more transient; it is a reflection of current pressures and interests. 
BST and NASA officials described the initial phases of the NASA initiative to change its 
culture, as well as less-detailed plans for future phases. 

The Space Shuttle Program provided a status of the NASA retum-to-flight plans. There were 
assurances that a limited tile repair capability would be certified prior to the launch of 
STS-114, along with a certification of the External Tank, although it was cautioned that some 
uncertainties would remain. It was noted that many certifications were in the yellow (accepted 
risk) category. The program stated that the non-ET debris allowables were zero; in other 
words, other elements were not allowed to generate any debris. The ET was treated 
differently, and there were specific requirements stated for allowable debris. The program 
provided a status on testing various Orbiter components to determine their ability to withstand 
debris impacts. It had already been determined through testing at the Glenn Research Center 
that certain Orbiter windows needed to be replaced with thicker glass. Testing of the tile and 
reinforced carbon-carbon continued. NASA also provided a status report for ground and flight 
cameras and on the proposed reorganization to meet CAIB R9.1-1 and its three subordinate 
recommendations. The Mission Management Team was the subject for a long discussion 
between Task Group members and NASA representatives. After this the program provided an 
update on Contingency Shuttle Crew Support, and answered a myriad of questions from the 
Task Group. 

6.7 Summary of December 2004 Plenary 

This plenary was held December 14-16, 2004, in Huntsville, Alabama. At the public meeting 
following two days of fact-finding, it was determined that NASA has made considerable 
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progress on meeting the CAIB recommendations for return to flight. The panels 
recommended, and the assembled Task Group approved, the complete closure of six 
assessments and the conditional closure of one additional assessment. 

However, considerable work remains. Eight items remain open, including some of the 
toughest technological challenges the recommendations present: shedding of debris, 
strengthening the reinforced carbon-carbon, hardening the Orbiter, and repair of the Thermal 
Protection System. Most of the operational issues have been addressed, with the largest 
remaining concern involving the ability to detect and repair damage to the Space Shuttle 
while on orbit. Some planning remains to be accomplished before the International Space 
Station can potentially be used as a “safe haven” for the crew of a damaged Orbiter while they 
await the launch of a rescue mission. NASA has also made substantial progress on the various 
management issues the CAIB cited as “half’ the cause of the demise of Columbia , but 
sufficient detail of plans, exercise of new capabilities and responsibilities, and adequate 
documentation remain open issues. 

Several of the CAIB return-to-flight recommendations involve enhanced imagery of the Space 
Shuttle during ascent and while on orbit. NASA has made sufficient progress on imagery to 
allow the RTF TG to fully or conditionally close three assessments (R3.4-1, R3.4-2, R6.3-2) 
and note substantial progress on a fourth (R3.4-3, which will be formally considered as part of 
R6.4-1, Thermal Protection System Inspection and Repair). 

Taken together, the changes in the capability to observe and examine the Space Shuttle during 
ascent will allow a more complete evaluation of the adequacy of the design and process 
changes made to the External Tank in the reduction of critical debris. The enhanced imagery 
will also contribute to the ability to conduct on-orbit inspections. There will undoubtedly be 
foam shed from the External Tank during the next and subsequent launches. The questions 
will be: how large are the pieces, where on the tank did the shedding occur, and where did the 
debris impact? The ascent imagery will help answer these questions. 
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Some months ago, it became clear that the immense amount of new data, much in the form of 
imagery, would require a new approach to integration. In response, NASA formed a 
development team that has produced a Thermal Protection System Operations Integration 
Plan intended to allow the Mission Management Team to make a timely entry readiness, 
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repair, or safe haven determination. The latest version of the plan, though still needing further 
simulation and testing, is very robust and a potential model for other integration activities 
within the Space Shuttle Program, as well as the Agency. 

Two assessments affecting closeout procedures (R4.2-3 and R10.3-1) were moved from 
conditionally closed to fully closed at the plenary. “Closeout” refers to the process of 
finalizing work on the vehicle, often in an area that is then sealed from further view or 
inspection. The requirement for two-person closeouts is simply intended to add an additional 
pair of eyes to the evaluation of the completed work before the area is sealed for flight. The 
requirement for digitized closeout photos is intended to yield an adequate ability to both 
examine work after closeouts and the ability to easily recall the images, particularly while the 
Space Shuttle is on-orbit. 

During the course of its investigation, the CAIB uncovered a technical deficiency in the bolt 
catcher, a device that prevents the explosive bolts used to mate the Solid Rocket Boosters to 
the External Tank from becoming debris that might impact the Orbiter. Although determined 
not to have contributed to the Columbia accident, the CAIB correctly wrote a 
recommendation (R4.2-1) requiring NASA to fix the problem. NASA has successfully 
redesigned, tested, and requalified the SRB bolt catcher, and the Task Group closed its 
assessment of this recommendation. 

Although most of the management-related recommendations remain open, NASA has made 
substantial progress since the last plenary. Most notably, the response to Recommendation 
7.5-1 (assessed as part of R9.1-1) to create an Independent Technical Authority (ITA) has 
been formulated, and implementation has begun. The first “warrants,” the official delegation 
of authority to specific individuals, have been issued. 

The role of the Mission Management Team, which received a great deal of attention 
immediately after the Columbia accident, has been clarified and expanded. The new Mission 
Management Team conducted 10 simulations of various aspects of the next mission and plans 
an end-to-end, full-mission simulation beginning in late February and lasting several days. 

The systems engineering and integration function, which the CAIB noted had gradually 
atrophied, has been reinvigorated and has an expansive role in return to flight. However, the 
RTF TG remains concerned that without adequate documentation, the renewed vigor will 
dissipate soon after the launch of STS-114. 

6.8 Summary of February 2005 Plenary 

This plenary was held on February 17, 2005, by teleconference. This public meeting was 
primarily to deliberate closing the Task Group assessment on R3.3-1, Reinforced Carbon- 
Carbon Non-destructive Inspection. The Recommendation had been conditionally closed in 
April 2004, and NASA submitted the requested additional data on February 2, 2005. The Task 
Group had evaluated the revised closure package and conducted fact-finding to verify the 
status of the recommendation. 

A public meeting was held after this plenary and members of the media were briefed during a 
press conference. After deliberating, the Task Group closed its assessment of R3.3-1, feeling 
that NASA had met the intent of the CAIB. 

6.9 Summary of the March 2005 Plenary 

This plenary was held March 28-30, 2005, in Houston, Texas, and was originally intended to 
be the final face-to-face meeting of the Task Group prior to writing the final report. However, 
in the weeks leading up to the meeting, it was apparent that NASA had not made sufficient 
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progress in documenting its compliance with the CAIB return-to-flight recommendations, and 
that it was unlikely all of the closure packages would be delivered to the Task Group in time 
to complete their assessments during the meeting. Therefore, even before the March 2005 
meeting convened, it was expected that another plenary would be needed before the launch of 
STS-114 to evaluate the final closure packages yet to be received from NASA. 

As the program’s schedules for delivering final closure packages to the Task Group continued 
to slip, the RTF TG began to wonder if any assessments could be made at the meeting. When 
the plenary was convened on March 22, 2005, the Task Group’s concerns were realized. 
During two days of fact-finding prior to a scheduled public deliberation scheduled for March 
24, the Task Group decided that insufficient documentation existed for any assessments to be 
made. The public meeting was cancelled. 

6.10 Summary of the Early June 2005 Plenary 

This plenary was held June 6-8, 2005, in Houston, Texas. By this time, NASA had provided 
preliminary or final closure packages for all of the remaining CAIB recommendations. Fact¬ 
finding was held the afternoon of June 6 and all day June 7, with the Space Shuttle Program 
Manager and various other program officials providing detailed status briefings to the Task 
Group. The Associate Administrator for Space Operations briefed the Task Group on June 7, 
presenting the perspective from NASA Headquarters on the upcoming STS-114 mission and 
the changes being implemented by the new NASA Administrator. 

The public meeting was held the morning of June 8, 2005. The Panel responsible for each 
recommendation provided a status or closure plan to the assembled Task Group, and in the 
end, the Task Group decided that five CAIB recommendations and the “raising the bar” Space 
Shuttle Program action had been completed. One of these, R3.4-1, Ground-Based Imagery, 
had been conditionally accepted during the December 2004 plenary; the Task Group now 
believed that NASA had provided the remaining data in a satisfactory manner and the 
recommendation was accepted to have fully met the intent of the CAIB. Four others: R3.4-3, 
High-Resolution Imagery of Orbiter; R6.2-1, Consistency with Resources; R6.3-1, Mission 
Management Team Improvements; and R9.1-1, Detailed Plan for Organizational Changes, 
were deliberated during the meeting. Task Group members agreed that the changes made by 
NASA for all four recommendations met the intent of the CAIB. 
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For the SSP-3, Contingency Shuttle Crew Support raising-the-bar action, the Task Group first 
discussed what criteria to measure against, since this was not a CAIB recommendation. 
Eventually, the Task Group decided that the original criteria defined by the Space Shuttle 
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Program would provide the measure, and it was agreed that the Space Shuttle and ISS 
Programs had both exceeded their initial goals. The Task Group concluded, “NASA set a 
raising the bar goal for itself and exceeded that goal by a significant margin.” 

This left only three recommendations for the Task Group to consider before the return to 
flight: R3.2-1, External Tank Debris Shedding; R3.3-2, Orbiter Hardening; and R6.4-1, 
Thermal Protection System Inspection and Repair. The work on these recommendations is on¬ 
going, with design reviews extended into late June. The Task Group decided to allow NASA 
additional time to complete work on these three recommendations and tentatively set a June 
27 date for the last Task Group plenary. It is expected that NASA will have submitted closure 
packages on these last three CAIB recommendations by the time of the last plenary. 

6.11 Summary of the Late June 2005 Plenary 

As the scheduled launch date of STS-114 approached, the Task Group and NASA attempted 
to come to closure on the final three assessments of the CAIB retum-to-flight 
recommendations. These included what many observers considered the most critical 
recommendations: R3.2-1, External Tank Debris Shedding; R3.3-2, Orbiter Hardening; and 
R6.4-1, Thermal Protection System Inspection and Repair. The major delay was that NASA’s 
final debris and design certification reviews were being conducted into late June, and the Task 
Group wanted to review the results of these reviews prior to completing their assessments. 
The final closure packages for R3.2-1 and R3.3-2 were not received by the Task Group until 
during the plenary meeting; R6.4-1 had been received earlier in June. 

A meeting was set between the Task Group leadership and the NASA Administrator for the 
morning of June 28, so the final plenary meeting was scheduled to occur in Washington, D.C., 
on June 27. This would allow the Task Group to work through the evening to ready the 
Executive Summary that would be delivered to the Administrator the following morning. 

Final fact-finding, including a required annual ethics briefing, was conducted during a closed 
meeting on the morning of June 27, with a public meeting held in the afternoon. The public 
meeting location had been changed late the day before because a broken fire sprinkler flooded 
the original location. The new location was approximately two blocks away. 

At the public meeting the Technical Panel recommended closing R3.2-1 and R3.3-2 as having 
met the intent of the CAIB. However, after spirited discussion, the majority of the Task Group 
voted that NASA had not met the intent of the CAIB for R3.2-1, although in both cases the 
Task Group felt that NASA had accomplished some excellent work. The majority of the Task 
Group also voted that NASA had not met the intent of the CAIB for R3.3-2, although again, 
the group felt that excellent work had been accomplished and that extenuating circumstances 
(the mandate to retire the Space Shuttle by 2010) understandably caused NASA to cancel 
some future work. Relative to R6.4-1, despite extensive efforts on the part of the Tile Repair 
Project and RCC Repair Project to develop a practicable TPS repair capability, the majority of 
the Task Group voted that the intent of CAIB Recommendation 6.4-1 had not been met, 
although there was a minority opinion that may be found elsewhere in this report. A press 
conference was held after the public meeting. 

An Executive Summary of this report was finalized in time to deliver it to the NASA 
Administrator on the morning of June 28, and copies were subsequently delivered to Congress 
and the White House. An electronic copy was posted to the Task Group’s website. The 
version contained at the beginning of this report has been slightly edited for readability 
without affecting its content. 
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APPENDIX A - RETURN TO FLIGHT TASK GROUP CHARTER 

The original Task Group charter is shown below. 


Establishment and Authority 

The NASA Administrator, having determined that it is in the public interest in connection 
with performance of the Agency duties under the law, and with the concurrence of the 
General Services Administration, establishes the NASA Return to Flight Task Group, 
pursuant to the Federal Advisory Committee Act (FACA), 5 U.S.C. App. §§1 et seq. 

Purpose and Duties 

1. The Task Group will perform an independent assessment of NASA’s actions to 
implement the recommendations of the Columbia Accident Investigation Board 
(CAIB), as they relate to the safety and operational readiness of STS-114. As 
necessary to its activities, the Task Group will consult with former members of 
the CAIB. 

2. While the Task Group will not attempt to assess the adequacy of the CAIB 
recommendations, it will report on the progress of NASA’s response to meet the 
intent. 

3. The Task Group may make other such observations on safety or operational 
readiness, as it believes appropriate. 

4. The Task Group will draw on the expertise of its members and other sources to 
provide its assessment to the Administrator. The Task Group will hold meetings 
and make site visits as necessary to accomplish its fact-finding. The Task Group 
will be provided information necessary to perform its advisory functions, 
including activities of both the Agency and its contractors. 

5. The Task Group will function solely as an advisory body and will comply fully 
with the provisions of the FACA. 

Organization 

The Task Group is authorized to establish panels in areas related to its work. The panels will 
report findings and recommendations to the Task Group. 

Membership 

In order to reflect a balance of views, the Task Group will consist of non-NASA employees 
and one NASA non-voting, ex officio member, the Deputy Associate Administrator for Safety 
and Mission Assurance. In addition, there may be associate members selected for Task Group 
panels. The Task Group may also request appointment of consultants to support specific tasks, 
members of the Task Group and panels will be chosen from among industry, academia, and 
government with recognized knowledge and expertise in fields relevant to safety and space 
flight. 

The Task Group members and the Co-Chairs of the Task Group will be appointed by the 
Administrator. At the request of the Task Group, associate members and consultants will be 
appointed by the Associate Deputy Administrator (Technical Programs). 
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Administrative Provisions 

1. The Task Group will formally report its results to NASA on a continuing basis 
at appropriate intervals, including a final written report. 

2. The Task Group will meet as often as required to complete its duties and will 
conduct at least two public meetings. Meetings will be open to the public, except 
when the General Counsel and the Agency Committee Management Officer 
determine that the meeting or a portion of it will be closed pursuant to the 
Government in the Sunshine Act or that the meeting is not covered by the 
Federal Advisory Committee Act. Panel meetings will be held as required. 

3. The Executive Secretary will be appointed by the Administrator and will serve 
as the Designated Federal Official. 

4. The Office of Space Flight will provide technical and staff support through the 
Task Force on International Space Station Operational Readiness. The Office of 
Space Flight will provide operating funds for the Task Group and panels. The 
estimated operating costs total approximately $2 million, including 17.5 work 
years for staff support. 

5. Members of the Task Group are entitled to be compensated for their services at 
the rate equivalent to a GS 15, step 10. Members of the Task Group will also be 
allowed per diem and travel expenses as authorized by 5 U.S.C. § 5701 et seq. 

Duration 

The Task Group will terminate 2 years from the date of this charter, unless terminated earlier 
or renewed by the NASA Administrator. 
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Charter Extension 

Because the Task Group did not complete their activities prior to the July 23, 2005, expiration 
of the original charter, an extension was required to complete the final report and prepare data 
for delivery to the National Archives. The revised charter is shown below. 

Establishment and Authority 

The NASA Administrator established the NASA Return to Flight Task Group (“Task 
Group”). Having determined that it is in the public interest in connection with performance of 
Agency duties under the law, and with the concurrence of the General Services 
Administration, the NASA Administrator hereby renews and amends the Task Group’s 
charter, pursuant to the Federal Advisory Committee Act (FACA), 5 U.S.C. App. §§1 et seq. 

Purpose and Duties 

1. The Task Group will perform an independent assessment of NASA’s actions to 
implement the recommendations of the Columbia Accident Investigation Board 
(CAIB), as they relate to the safety and operational readiness of STS-114. As 
necessary to its activities, the Task Group will consult with former members of 
the CAIB. 

2. While the Task Group will not attempt to assess the adequacy of the CAIB 
recommendations, it will report on the progress of NASA’s response to meet the 
intent. 

3. The Task Group may make other such observations on safety or operational 
readiness, as it believes appropriate. 

4. The Task Group will draw on the expertise of its members and other sources to 
provide its assessment to the Administrator. The Task Group will hold meetings 
and make site visits as necessary to accomplish its fact-finding. The Task Group 
will be provided information necessary to perform its advisory functions, 
including activities of both the Agency and its contractors. 

5. The Task Group will function solely as an advisory body and will comply fully 
with the provisions of the FACA. 

Organization 

The Task Group is authorized to establish panels in areas related to its work. The panels will 
report findings and recommendations to the Task Group. 

Membership 

To reflect a balance of views, the Task Group will consist of non-NASA employees and one 
NASA nonvoting, ex officio member, the Deputy Chief Safety and Mission Assurance 
Officer. In addition, there may be associate members selected for Task Group panels. The 
Task Group may also request appointment of consultants to support specific tasks. Members 
of the Task Group and panels will be chosen from among industry, academia, and government 
with recognized knowledge and expertise in fields relevant to safety and space flight. 

The Task Group members and the Co-Chairs of the Task Group will be appointed by the 
Administrator. At the request of the Task Group, associate members and consultants will be 
appointed by the Deputy Chief Engineer/Independent Technical Authority. 
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Administrative Provisions 

1. The Task Group will formally report its results to NASA on a continuing basis 
at appropriate intervals, including a final written report. 

2. The Task Group will meet as often as required to complete its duties and will 
conduct at least two public meetings. Meetings will be open to the public, except 
when the General Counsel and the Agency Committee Management Officer 
determine that the meeting or a portion of it will be closed pursuant to the 
Government in the Sunshine Act or that the meeting is not covered by the 
FAC A. Panel meetings will be held as required. 

3. The Executive Secretary will be appointed by the Administrator and will serve 
as the Designated Federal Official. 

4. The Space Operations Mission Directorate will provide technical and staff 
support through the Task Force on International Space Station Operational 
Readiness. The Space Operations Mission Directorate will provide operating 
funds for the Task Group and panels. The estimated operating costs total 
approximately $3.5 million which includes 7 workyears for staff support. 

5. Members of the Task Group are entitled to be compensated for their services at 
the rate equivalent to a GS 15, step 10. Members of the Task Group will also be 
allowed per diem and travel expenses as authorized by 5 U.S.C. § 5701 et seq. 

Duration 

The Task Group shall terminate upon the issuance of its final report unless terminated before 
that date or subsequently renewed by the NASA Administrator. 



Administrator 


JUL 2 2 2005 

Date 


Page 152 of 216 



Final Report of the Return to Flight Task Group 


APPENDIX B - RTF TG MEMBERS 

Lieutenant General Thomas P. Stafford, U.S. Air Force (Retired) 

Co-Chair, Return to Flight Task Group 

President, Stafford, Burke & Hecker Inc., technical consulting firm 

A member of NASA’s second astronaut group, Stafford 
was pilot of Gemini 6 and commanded Gemini 9, and 
orbited the moon as Commander of Apollo 10. He was 
the American Commander in the Apollo-Soyuz Test 
Project, the first rendezvous between American and 
Soviet spacecraft. Stafford became head of the 
astronaut group and was later named Deputy Director 
of Flight Crew Operations at the NASA Manned 
Spaceflight Center. He left NASA in 1975 to head the 
Air Force Test Flight Center and in 1978 became 
Deputy Chief of Staff, Research, Development and 
Acquisition, U.S. Air Force Headquarters. A consultant 
since 1980, Stafford is Chairman of the NASA 
Advisory Council Task Force on International Space 
Station Operational Readiness. He served as Defense Adviser to President Ronald Reagan and 
headed The Synthesis Group, which planned for the U.S. return to the moon and eventual 
Mars missions. He was Chairman of the NASA Advisory Council Task Force on Shuttle-Mir 
Rendezvous and Docking Missions. Among his awards, Stafford received the Congressional 
Space Medal of Honor. He served on the National Research Council’s Aeronautics and Space 
Engineering Board, the Committee on NASA Scientific and Technological Program Reviews, 
and the Space Policy Advisory Council. Stafford is an graduate of the U.S. Naval Academy. 



Colonel Richard O. Covey, U.S. Air Force (Retired) 

Co-Chair, Return to Flight Task Group 
President, Boeing Service Company 

Colonel Covey is a veteran of four Space Shuttle 
flights. He was the pilot of Discovery on the first 
retum-to-flight mission following the Challenger 
accident, and he was commander of Endeavour on the 
first mission to service and repair the Hubble Space 
Telescope. He also held management positions in the 
Astronaut Office and Flight Crew Operations 
Directorate. As a fighter pilot, Covey flew 339 combat 
missions in Southeast Asia. He was an F-4 and A-7D 
weapons systems test pilot and Joint Test Force 
Director for electronic warfare testing of the F-15. 

Covey’s organization at Boeing supports commercial 
and U.S. government space and communication 
programs. Earlier, he was Vice President of Boeing’s 
Houston operations. Covey has received 27 Defense Department and Air Force medals, plus 
the National Intelligence Medal of Achievement. NASA awarded him the Distinguished 
Service Medal, the Outstanding Leadership Medal, and the Exceptional Service Medal. For 
his role on the Hubble servicing mission, Covey and his crew received both the Goddard 
Trophy and the Collier Trophy. He holds a B.S. in Engineering Sciences from the U.S. Air 
Force Academy and an M.S. in Aeronautics and Astronautics from Purdue University, and 
was named the Outstanding Graduate of his class at the Air Force Test Pilot School. 
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Colonel James C. Adamson, U.S. Army (Retired) 

CEO, Monarch Precision, LLC 


Colonel Adamson, a former astronaut, earned his B.S. 
in Engineering from the U.S. Military Academy at West 
Point and his M.S. in Aerospace Engineering from 
Princeton University. He returned to West Point as an 
Assistant Professor of Aerodynamics, after which he 
was selected to attend the Navy Test Pilot School. In 
1981 he became Aerodynamics Officer for the Space 
Shuttle Operational Flight Test Program. Adamson 
became an astronaut in 1984 and flew two missions, 
one aboard Columbia and the other on Atlantis. After 
retiring from NASA, Adamson established his own 
consulting firm, Monarch Precision, and then became 
President/CEO of Lockheed Engineering and Sciences 
Company. In 1995 he helped create United Space 
Alliance and became the company’s first Chief 
Operating Officer. Adamson was then recruited to serve as President/CEO of Allied Signal 
Technical Services Corporation, which later became Honeywell Technology Solutions, Inc. 
Retiring from Honeywell in 2001; Adamson resumed part-time consulting with Monarch 
Precision. In addition to corporate board positions, he has served as a member of the NASA 
Advisory Council Task Force on Shuttle-Mir Rendezvous and Docking Missions and is 
currently a member of the NASA Advisory Council Task Force on International Space Station 
Operational Readiness. 



Major General William A. Anders, U.S. Air Force Reserve (Retired) 

Major General Anders was selected for the astronaut 
corps in 1963. He was the Lunar Module Pilot of 
Apollo 8 and backup Command Module Pilot for 
Apollo 11. Anders subsequently received Presidential 
appointments to the National Aeronautics and Space 
Council, the Atomic Energy Commission and the 
Nuclear Regulatory Commission (where he was the 
first Chairman), and he served as U.S. Ambassador to 
Norway. Anders held executive positions at a number 
of corporations, including General Electric, Textron and 
General Dynamics, where he was Chairman and CEO. 
While in that position, he was awarded the National 
Security Industrial Association’s “CEO of the Year” 
award. Anders established several world flight records 
and has received numerous awards, including Distinguished Service Medals from the Air 
Force, NASA and the Atomic Energy Commission. He is a member of the National Academy 
of Engineering, the Society of Experimental Test Pilots and the Experimental Aircraft 
Association. He is also the founder and President of the Heritage Flight Museum. Anders 
received his B.S. in Electrical Engineering from the United States Naval Academy and earned 
his pilot’s wings in 1956. He received his M.S. in Nuclear Engineering from the U.S. Air 
Force Institute of Technology, graduating with honors. 
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Dr. Walter D. Broadnax, Ph.D 

President, Clark Atlanta University 

Prior to his current position, Dr. Broadnax was Dean of 
the School of Public Affairs, American University, and 
Professor of Public Policy and Management at the 
University of Maryland, where he directed the Bureau 
of Governmental Research. Broadnax also served as: 

Deputy Secretary and Chief Operating Officer, U.S. 

Department of Health and Human Services; President, 

Center for Governmental Research; President, New 
York State Civil Service Commission; Lecturer and 
Director, Kennedy School of Government, Harvard 
University; Senior Staff Member, Brookings Institution; 

Principal Deputy Assistant Secretary for Planning and 
Evaluation, U.S. Department of Health, Education and 
Welfare; Director, Children, Youth and Adult Services, 

State of Kansas; and Professor, Federal Executive Institute. Broadnax has held leadership 
positions in professional associations such as: the American Political Science Association, the 
Association of Public Policy and Management and the American Society for Public 
Administration. Broadnax received his Ph.D. from the Maxwell School at Syracuse 
University, his B.A. from Washburn University and his M.P.A from the University of Kansas. 
He has served as President, American Society for Public Administration, Fellow, National 
Academy of Public Administration and Trustee of the Academy’s Board. He is a member of 
the Syracuse University Board of Trustees, Harvard University’s Taubman Center Advisory 
Board and the United States Comptroller General Advisory Board. 



Dr. Kathryn I. Clark, Ph.D. 

President, Docere (consulting firm specializing in science and education) 

Dr. Clark served as NASA’s Chief Scientist for the 
International Space Station Program and as Chief 
Scientist for the Human Exploration and Development 
of Space Enterprise. Her particular interest is in human 
factors, the elements necessary for the health, safety 
and efficiency of crews in long-duration space flight. 

Clark served as Deputy Director of the Center for 
Microgravity Automation Technology, one of the 
NASA Commercial Space Centers. Clark’s NASA 
experience began with a neuromuscular development 
study that flew on Atlantis in 1994. These experiments 
were repeated and augmented on Discovery in 1995. 

She was also involved in the Neurolab project flown on 
Columbia in 1998 and a student-designed ladybug 
experiment that flew on Columbia in 1999. Clark is the recipient of the NASA Goddard Space 
Flight Center Customer Service Excellence Award. Clark received both her M.S. and Ph.D. from 
the University of Michigan and then joined the university faculty in the Department of Cell 
and Developmental Biology in 1993. Clark chairs the Academic Affairs Committee, Board of 
Control, Michigan Technological University. She also serves on the Board of Trustees of the 
Western Reserve Academy and the Board of Advisors of the Jean Michel Cousteau Society. 
She serves on the boards of the Space Day Foundation and Orion’s Quest, both education- 
oriented not-for-profit organizations. Clark is also a member of the NASA Advisory Council 
Task Force on International Space Station Operational Readiness. 
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Mr. Benjamin A. Cosgrove 

Consultant 

In the course of a 44-year career with the Boeing 
Company, Mr. Cosgrove was an engineer and manager 
associated with most of the company’s jet aircraft 
programs. He served as stress engineer or structural unit 
chief on the B-47, B-52, and KC-135, and on the Boeing 
707, 727, 737, and 747 jetliners. He was Chief Engineer 
of the 767. Cosgrove was honored by Aviation Week & 
Space Technology for his role in converting the Boeing 
767 transport design from a three-member to two-member 
cockpit configuration, and he received the Ed Wells 
Technical Management Award for his work addressing 
issues of aging aircraft. Cosgrove received the National 
Aeronautics Association’s Wright Brothers Memorial 
Trophy for his lifetime contributions to commercial 
aviation safety and for technical achievement. He is a member of the National Academy of 
Engineering and a fellow of both the American Institute of Aeronautics and Astronautics and 
the Royal Aeronautical Society. After retiring in 1993 as Senior Vice President, Boeing 
Commercial Airplane Group, Cosgrove became a consultant. Cosgrove was elected to the 
National Academy of Engineering in 1992. He holds both a B.S. in Aeronautical Engineering 
and an honorary Doctorate of Engineering from the University of Notre Dame. Cosgrove has 
served on the NASA Advisory Committee’s Task Force on International Space Station 
Operational Readiness and the Committee on Space Shuttle Upgrades. 



Dr. Dan L. Crippen, Ph.D. 

Former Director, Congressional Budget Office 

Dr. Crippen served as the fifth Director of the 
Congressional Budget Office. His public service 
positions have also included: Chief Counsel and 
Economic Policy Adviser to the Senate Majority Leader 
(1981-1985); Deputy Assistant to the President for 
Domestic Policy (1987-1988); and Domestic Policy 
Advisor and Assistant to the President for Domestic 
Policy (1988-1989) - a position in which he advised the 
President on all issues relating to domestic policy, 
including the preparation and presentation of the federal 
budget. He has served on several national commissions, 
including the National Commission on Financial 
Institution Reform, Recovery, and Enforcement. He 
currently serves on the Aerospace Safety Advisory 
Panel. Crippen has substantial experience in the private sector as well. Before joining the 
CBO, he was a principal with Washington Counsel, a law and consulting firm. He has also 
served as Executive Director of the Merrill Lynch International Advisory Council and as a 
founding partner and Senior Vice President of The Duberstein Group, an independent 
strategic planning and consulting firm. Crippen received a B.A. from the University of South 
Dakota in 1974, an M.A. from Ohio State University in 1976, and a Ph.D. in Public Finance 
from Ohio State in 1981. 
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Mr. Joseph W. Cuzzupoli 

Vice President and K-l Program Manager, Kistler Aerospace Corporation 


sa 


Mr. Cuzzupoli has more than 40 years of experience in 
aerospace engineering and management. He began his 
career with General Dynamics as Launch Director 
(1959-1962), and then became Manager of 
Manufacturing/Engineering and Director of Test 
Operations for Rockwell International (1962-1966). As 
Rockwell’s Assistant Program Manager for Apollo, 

Cuzzupoli managed the building and testing of Apollo 
6, Apollo 8, Apollo 9, and Apollo 12. He later became 
Rockwell’s Vice President of Operations and then Vice 
President and Program Manager for the Space Shuttle 
Orbiter Project. Cuzzupoli left Rockwell in 1980 and 
consulted on various aerospace projects for NASA 
centers until 1991 when he joined American Pacific 
Corporation as Senior Vice President. In his current position at Kistler Aerospace, he has 
primary responsibility for design and production of the K-l reusable launch vehicle. 
Cuzzupoli holds a B.S. in Mechanical Engineering from the Maine Maritime Academy, a B.S. 
in Electrical Engineering from the University of Connecticut and a Certificate of 
Management/Business Administration from the University of Southern California. He was a 
member of the NASA Advisory Council’s Task Force on Shuttle-Mir Rendezvous and 
Docking Missions and is a current member of the Council’s Task Force on International 
Space Station Operational Readiness. 



Dr. Charles C. Daniel, Ph.D. 

Engineering Consultant 

From Saturn V to the International Space Station (ISS), 

Dr. Daniel has served as an engineer and manager in 
space flight vehicle design, analysis, integration and 
testing. His career began in 1968 at the Marshall Space 
Flight Center (MSFC) where he supported Saturn 
Instrument Unit operations for Apollo 11, 12 and 13. 

He performed avionics integration work for the Skylab 
program. For the Space Shuttle’s Solid Rocket Boosters 
(SRB), he developed avionics and served as Flight 
Operations Lead. Daniel worked with the original 
Space Station Skunk Works for definition of the space 
station concept and developed the project’s master 
engineering schedule. Following the Challenger 
accident, he led the evaluation of all Space Shuttle 
hazard analyses and coordinated acceptance analyses associated with modifications to the 
SRBs. During Space Station Freedom development, he was the Avionics Lead and served as 
MSFC Lead for Level II assembly and configuration development. Daniel helped plan 
Russian participation in the Space Station Restructure activity and later returned to MSFC as 
Chief Engineer for Space Station. Daniel holds a Ph.D. in Engineering and has completed 
postgraduate work at the University of California, Berkeley and MIT. He has served on one 
NASA Advisory Council task force on Shuttle-Mir Rendezvous and Docking Operations and 
another on ISS Operational Readiness. 
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Dr. Amy K. Donahue, Ph.D. 

Assistant Professor of Public Policy, the University of Connecticut 

Dr. Donahue teaches in the Master of Public 
Administration and Master of Survey Research 
programs. Her research focuses on productivity of 
emergency services organizations and on the nature of 
citizen demand for public safety services. Her published 
work deals with the design, management and finance of 
fire departments and other public agencies. Donahue 
has served as technical adviser to the Department of 
Homeland Security’s Science and Technology 
Directorate, helping to develop programs for 
emergency responders. As Senior Adviser to the NASA 
Administrator from 2002 to 2004, Donahue sought 
opportunities within NASA to contribute to homeland 
security efforts government-wide. Donahue has 20 
years of field experience and training in an array of 
emergency services-related fields, including managing a 911 communications center, and 
working as a firefighter and emergency medical technician in Fairbanks, Alaska and upstate 
New York. In addition, she has served as an officer in the U.S. Army’s Medical Service 
Corps. In 2003, Donahue spent three months in the field in Texas managing the Columbia 
debris recovery operation. Donahue currently serves on the Aerospace Safety Advisory Panel 
(ASAP). Donahue received her B.A. in Geological and Geophysical Sciences from Princeton 
University and both her Ph.D. in Public Administration and her M.P.A. from the Maxwell 
School of Citizenship and Public Affairs, Syracuse University. Donahue currently serves on 
the Aerospace Safety Advisory Panel (ASAP). 



General Ronald R. Fogleman, U.S. Air Force (Retired) 

President and Chief Operating Officer, Durango Aerospace Inc. 

General Fogleman has experience in air and space 
operations, expertise in long-range programming and 
strategic planning and extensive training in fighter and 
mobility aircraft. He served in the Air Force for 34 
years, culminating in his appointment as Chief of Staff, 
after which he retired in 1997. Fogleman has served as 
a military adviser to the Secretary of Defense, the 
National Security Council and the President of the 
United States. Among other advisory boards, he is a 
member of the National Defense Policy Board, the 
NASA Advisory Council, the Jet Propulsion Laboratory 
Advisory Board, the Council on Foreign Relations, and 
the congressionally directed Commission to Assess 
United States National Security Space Management and 
Organization. He chaired the National Research Council Committee on Aeronautics Research 
and Technology for Vision 2050. Fogleman received an M.A. in Political Science from Duke 
University, graduated from the Army War College, and earned an M.A. in Military History 
from the U.S. Air Force Academy. His military decorations include: Defense Distinguished 
Service Medal with two oak leaf clusters; the Air Force Distinguished Service Medal with oak 
leaf cluster; both the Army and Navy Distinguished Service Medals; Silver Star; Purple Heart; 
Meritorious Service Medal; and two Distinguished Flying Crosses. 
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Ms. Christine H. Fox 

President, Center for Naval Analyses 

A President of the CNA, a federally-funded research 
and development center, Ms. Fox is responsible for 
providing the Department of the Navy and Department 
of Defense with high-quality, independent analysis of 
key issues regarding manning, training, acquisition, and 
operations. Before becoming President, Fox was the 
Vice President and Director of the Center’s Operations 
Evaluation Group. With approximately 45 field 
representatives and 45 Washington-based analysts, this 
group’s analytical purpose is to help operational 
commanders execute their missions. Fox joined the 
CNA in 1981 and since then has served in a variety of 
analysis, leadership and management positions. These 
positions include: Team Leader, Operational Policy 
Team; Director, Anti-Air Warfare Department; Program Director, Fleet Tactics and 
Capabilities; Team Leader of Third Fleet Tactical Analysis Team; Field Representative to 
Tactical Training Group - Pacific; Project Director, Electronic Warfare Project; Field 
Representative to Fighter Airborne Early Warning Wing - U.S. Pacific Fleet; and Analyst, 
Air Warfare Division, Operations Evaluation Group. Fox received her B.S. in mathematics 
and her M.S. in applied mathematics from George Mason University. 



Colonel Gary S. Geyer, U.S. Air Force (Retired) 

Consultant 

Colonel Geyer has 39 years of experience in space 
engineering and program management. In senior 
positions in both government and industry, he has been 
responsible for all aspects of system success, including 
schedule, cost and technical performance. He served for 
26 years with the National Reconnaissance Office 
(NRO) and was the NRO System Program Office 
Director for two major programs, responsible for 
design, manufacture, test, launch and operation of 
several of the most important U.S. reconnaissance 
satellites. Geyer was one of 46 “Pioneers of National 
Reconnaissance” honored by the NRO in 2000 for their 
“significant and lasting contributions to the discipline 
of national reconnaissance,” which contributed to the end of the Cold War. Following his 
NRO service, Geyer was Vice President for a major classified program at Lockheed Martin, 
where he was responsible for all aspects of program and mission success. Geyer teaches 
courses in space design and system engineering/ program management at New Mexico State 
University. He has a B.S. in Electrical Engineering from Ohio State University, an M.S. in 
Electrical Engineering, and M.S. in Aeronautical Engineering from the University of Southern 
California. 
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Brigadier General (Select) Susan J. Helms, U.S. Air Force 

Deputy Director, Operations for Technical Training, Headquarters Air Education and 
Training Command 


Before her current assignment, Colonel Helms was 
Vice Commander of the 45th Space Wing where she 
oversaw military space launches from Cape Canaveral 
Air Force Station (CCAFS) and Eastern Range support 
for commercial, NASA and military space launches 
from CCAFS and Kennedy Space Center, along with 
ballistic missile tests at sea. Selected for the astronaut 
program in 1990, she flew on five Space Shuttle flights 
and served aboard the International Space Station as 
member of the Expedition 2 crew. She logged 211 days 
in space, including a world-record extravehicular 
activity of 8 hours, 56 minutes. After receiving a B.S. in 
Aeronautical Engineering from the U.S. Air Force 
Academy and her commission, Helms was assigned to the Air Force Armament Laboratory as 
F-16 Weapons Separation Engineer, and then became Lead Engineer, F-15 weapons 
separation. In 1985 she received her M.S. in Aeronautics/Astronautics from Stanford 
University and returned to the Air Force Academy as Assistant Professor of Aeronautics. 
After attending the Air Force Test Pilot School in 1988, Helms was assigned as Exchange 
Officer to Canada’s Aerospace Engineering Test Establishment, where she worked as Flight 
Test Engineer and Project Officer on the CF-18. She was managing development of a CF-18 
flight control system simulation when selected by NASA. Helms returned to the Air Force in 
2002 to direct the Space Superiority Division, Space Command Requirements Directorate. 



Mr. Richard H. Kohrs 

Chief Engineer, Kistler Aerospace Corporation 

Mr. Kohrs has over 40 years of experience in aerospace 
systems engineering, stress analysis and integration. He 
has held senior management positions in NASA 
programs from Apollo to Space Station. After Apollo, 
Kohrs’s positions in the Space Shuttle Program 
included Manager of System Integration, Deputy 
Manager and then Deputy Director. As Deputy 
Director, he was responsible for the daily engineering, 
processing and operations activities of the Shuttle 
Program, and he developed an extensive background in 
Shuttle systems integration. In 1989, Kohrs became 
Director of Space Station Freedom, with overall 
responsibility for its development and operation. After 
years of public service, he left NASA to become 
Director of the ANSER Center for International Aerospace Cooperation (1994-1997). Kohrs 
joined Kistler Aerospace in 1997. His primary responsibilities as Chief Engineer include 
vehicle integration, design specifications, design data books, interface control, vehicle weight, 
performance and engineering review board matters. In 1956, he received a B.S. from 
Washington University in St. Louis. 
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Ms. Susan Morrisey Livingstone 

Policy and Management Consultant 

From 2001 to 2003, Ms. Livingstone served as Under 
Secretary of the Navy. Her broad executive 
management portfolio comprised planning, budget and 
other functions, but she also focused on programs such 
as space, information technology, and criminal 
investigation. Currently, she serves on the Maxwell 
School’s National Security Studies Board of Advisers 
and the Secretary of the Navy’s Subcommittee on 
Naval History. Livingstone was CEO of the Association 
of the United States Army and Deputy Chairman of its 
Council of Trustees. She was a consultant to the 
Defense Science Board. At American Red Cross 
headquarters, her executive positions included Vice 
President, Health and Safety Services. Livingstone was 
Assistant Secretary of the Army for Installations, Logistics and Environment (1989-1993). 
Among several posts at the former Veterans Administration, Livingstone was Associate 
Deputy Administrator for Logistics. She worked on personal staffs of a Senator and two 
Congressmen. Livingstone received the Secretary of Defense Award for Outstanding Public 
Service and the highest civilian awards from the National Reconnaissance Office, the VA, and 
the Army and Navy Departments. Livingstone received her B.A. from the College of William 
and Mary (1968) and her M.A. in Political Science from the University of Montana (1972), 
and post graduate work at the Fletcher School of Law and Diplomacy. 



Mr. James D. Lloyd, ex-officio 

Deputy Chief Safety and Mission Assurance Officer, NASA 

Mr. Lloyd has extensive experience in safety 
engineering and risk management and has supported a 
number of blue ribbon panels addressing safety 
problems. Beginning in 1969 as a safety engineering 
intern trainee and later as a journeyman system safety 
engineer with the U. S. Army Aviation Systems 
Command, he honed his skills with Army aircraft 
development programs. He was later appointed as 
Chief, Program Evaluation Division in the Army 
Material Command (AMC) Safety Office in Virginia. 

In 1979, he was again reassigned as Director, AMC 
Field Safety Activity in Indiana, where he managed 
safety engineering, evaluation and training support for 
the command’s military-industrial operations located world-wide. After the Space Shuttle 
Challenger disaster in 1986, Lloyd joined NASA to help the Agency rebuild its SMA 
program. He was instrumental in fulfilling several of the recommendations from the Rogers 
Commission investigation report. Immediately after Space Shuttle flights resumed, Lloyd 
moved to the Space Station Freedom Program Office in Virginia, where he served in various 
roles culminating in Product Assurance Manager for the program. In 1993 he became 
Director, Safety and Risk Management Division, Office of Safety and Mission Assurance, 
serving as NASA’s “Safety Director.” He assumed his present position as Deputy Chief of 
the same office in 2003. Lloyd also serves as ex-officio member for the NASA 
Advisory Council’s standing Task Force on International Space Station Operational 
Readiness. Lloyd holds a B.S. with honors in Mechanical Engineering from Union College, 
Schenectady, and an M.S. in Industrial Engineering, Texas A&M University. 
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Lieutenant General Forrest S. McCartney, U.S. Air Force (Retired) 

Consultant 


Lt. General McCartney was Commander of the 
Ballistic Missile Organization (responsible for 

development of the Minuteman and Peacekeeper 
ICBMs), Commander of the Air Force Space Division 
and Vice Commander, Air Force Space Command. He 
directed several major satellite programs. He received 
the Distinguished Service Medal, Legion of Merit with 
one oak leaf cluster, Meritorious Service Medal and Air 
Force Commendation Medal with three oak leaf 
clusters, as well as the General Thomas D. White Space 
Trophy and the Military Astronautical Trophy. 

Following the Challenger accident, McCartney was 
assigned to NASA and served as Director of the 
Kennedy Space Center until 1992. His numerous 
awards include NASA’s Distinguished Service Medal, the Presidential Rank Award, the 

National Space Club Goddard Memorial Trophy and the AIAA Von Braun Award for 

Excellence in Space Program Management. After 40 years of military and civil service, 
McCartney became an industry consultant, specializing in evaluation of hardware failure and 
flight readiness. At Lockheed Martin, from 1994 to 2001, he was Astronautics Vice President 
for Launch Operations. McCartney was Vice Chairman of the NASA Aerospace Safety 
Advisory Panel. He has a B.S. in Electrical Engineering from Auburn University, an M.S. in 
Nuclear Engineering from the Air Force Institute of Technology and an honorary doctorate 
from the Florida Institute of Technology. 



Dr. Rosemary O’Leary, Ph.D 

Distinguished Professor of Public Administration and Political Science, Syracuse University 

As the Co-Director of the Program for the Analysis and 
Resolution of Conflict at the Maxwell School of 
Syracuse University, O’Leary also coordinates the 
Ph.D. program in public administration. A member of 
the NASA Aerospace Safety Advisory Panel and the 
National Academy of Public Administration, she was a 
Senior Fulbright Scholar in Malaysia and the 
Philippines. Previously, O’Leary was Professor of 
Public and Environmental Affairs at Indiana University 
and Co-Founder and Co-Director of the Indiana 
Conflict Resolution Institute. She served as Director of 
Policy and Planning for the Kansas Department of 
Health and Environment and has worked as an 
environmental attorney. O’Leary is the author or editor 
of seven books and more than 90 articles and has won 
nine national research awards. She was awarded the Syracuse University Chancellor’s 
Citation for Exceptional Academic Achievement, the highest research award at the university, 
and she has won eight teaching awards. She received the Distinguished Service Award of the 
American Society for Public Administration. O’Leary was Chair of the Public Administration 
Section, American Political Science Association, and the Section on Environment and Natural 
Resources Administration, American Society for Public Administration. O’Leary has a Ph.D. 
in Public Administration from The Maxwell School of Syracuse University, and a J.D., 
M.P.A., and B.S from the University of Kansas. 
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Dr. Decatur B. Rogers, Ph.D. 

Dean, College of Engineering, Technology and Computer Science, Tennessee State University 

Dr. Rogers has held the post of Dean since 1988, and he 
is also Professor of Mechanical Engineering. Before 
joining the faculty of Tennessee State University in 
Nashville, he was Professor and Dean at: Florida State 
University, Tallahassee; Prairie View A&M University, 

Prairie View, Texas; and Federal City College, 

Washington, D.C. At Tennessee State, Rogers has 
fostered a number of collaborations with fellow 
universities and other partners, such as NASA, Boeing, 

General Motors and the Office of Naval Research. One 
of these collaborations is the Strategic Manpower 
Development Project, which aims to increase the 
number of African Americans pursuing doctorates in 
the fields of engineering, technology and computer 
science. Rogers’s areas of expertise include: mechanical and thermal engineering; heating, 
ventilation and air conditioning; two-phase flow; heat transport systems; and engineering 
management. Examples of his publication titles include: Thermodynamics of Fiber-Power 
Insulation; The Engineering Pipeline: A Long-Term Talent Development Strategy for 
Minorities on the Recruitment and Retention of Minorities and Women in Engineering and 
Preparing Black Children to Become Engineers. Rogers holds a Ph.D. in Mechanical 
Engineering from Vanderbilt University, an M.S. in Engineering Management and another in 
Mechanical Engineering from Vanderbilt University and a B.S. in Mechanical Engineering 
from Tennessee State University. 



Mr. Seymour Z. Rubenstein 

Aerospace Consultant and Former President of the Rockwell International Space Systems 
Division 

Mr. Rubenstein has been a leader in commercial and 
government projects for more than 35 years. He served 
as President of the Rockwell International Space 
Systems Division and was a major contributor to the 
design, development and operation of the Space 
Shuttle. At Rockwell, the prime contractor for the 
Space Shuttle, he was the Director of Avionics System 
Engineering during the early development of the 
spacecraft. Subsequently he was promoted to Vice 
President of Engineering and Chief Engineer for Space 
Shuttle Development, followed in 1979 by Vice 
President and Program Manager. He then advanced to 
the position of President of the Rockwell Space Station 
Division before becoming the Space Division President. After his tenure at Rockwell, 
Rubenstein held several positions at McDonnell Douglas. For his contributions to manned 
space exploration and in recognition of his skills as an innovator and problem solver, 
Rubenstein has received the NASA Public Service Medal, the NASA Medal for Exceptional 
Engineering and the Space Systems Award of the American Institute of Aeronautics and 
Astronautics. He is a Fellow of both the AIAA and the American Astronautical Society. Mr. 
Rubenstein holds an MBA from California State University, an MEE from New York 
University, a B.S. in Electrical Engineering from MIT, and a certificate of completion from 
the Stanford Executive Program. 
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Mr. Robert B. Sieck 

Aerospace Consultant 


Mr. Sieck, former Director of Shuttle Processing at the 
Kennedy Space Center (KSC), has an extensive 
background in Space Shuttle systems, testing, launch, 
landing and processing. After serving in the Air Force 
involved with the activation of Titan II missiles, joined 
NASA in 1964 as Gemini Spacecraft Systems Engineer 
and served as Apollo Spacecraft Test Team Project 
Engineer. He became Shuttle Orbiter Test Team Project 
Engineer and was named Engineering Manager for the 
Shuttle Approach and Landing Tests at Dry den Flight 
Research Facility. Sieck was the Chief Shuttle Project 
Engineer for missions STS-1 through STS-7 and 
became the first KSC Shuttle Flow Director in 1983. He 
was appointed Director, Launch and Landing 
Operations, in 1984, serving as Shuttle Launch Director in 1984 and 1985. After the 
Challenger accident in 1986 he was again appointed Launch Director, and also Deputy 
Director, Shuttle Operations (1992-1995). He was Launch Director for the retum-to-flight of 
STS-26R and all subsequent Shuttle missions through STS-63. He was appointed Director of 
Shuttle Processing in 1995. After his retirement from NASA, Sieck served with the NASA 
Aerospace Safety Advisory Panel. He earned his B.S. in Electrical Engineering, University of 
Virginia, in 1960 and had post graduate work at Texas A&M and the Florida Institute of 
Technology. 



Mr. Thomas N. Tate 

Consultant 


Mr. Tate was Vice President of Legislative Affairs for 
the Aerospace Industries Association for 17 years. 
Before joining AIA in 1987, he served on the staff of 
the House Committee on Science and Technology in 
positions that included Counsel and Special Assistant to 
the Chairman. He also served with the House 
Subcommittee on Space Science and Applications and 
the House Subcommittee on Energy Research and 
Development. At the Space Division of Rockwell 
International, 1962-1973, Tate worked in engineering 
and marketing on programs such as the Gemini 
Paraglider, Apollo, Apollo/Soyuz, and the Space 
Shuttle. He eventually became Director of Space 
Operations. Earlier, he worked for RCA’s Missile and 
Surface Radar Division (1958-1962), and he served in the U.S. Army as Artillery and Guided 
Missile Officer. Tate received a B.S. from the University of Scranton, 1956. With his 1970 
J.D. from Western State University College of Law, he was named that year’s most 
outstanding student. In 1991, he received the University of Scranton’s Frank J. O’Hara Award 
for Distinguished Alumni in Science and Technology. Tate is adviser to the National Space 
Institute and member of aerospace and defense associations such as AIAA and the National 
Space Club. For 15 years, Tate served on the NASA Senior Executive Service Salary and 
Performance Review Board. 
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Dr. Kathryn C. Thornton, Ph.D. 

Professor, School of Engineering & Applied Science, University of Virginia 

Dr. Thornton teaches in the Department of Science, 

Technology and Society and in the Department of 
Mechanical and Aerospace Engineering. She also 
manages the Graduate Studies Office as Associate Dean 
for Graduate Programs. Selected as an astronaut in 
1984, Thornton is a veteran of four Space Shuttle 
flights between 1989 and 1995, including the maiden 
flight of Endeavour in 1992 and the first Hubble Space 
Telescope Service Mission in 1993. She was Payload 
Commander in 1995 on the second U.S. Microgravity 
Laboratory mission. She has logged over 975 hours in 
space, including more than 21 hours of extravehicular 
activity. Her technical assignments at NASA included 
flight software verification in the Shuttle Avionics 
Integration Laboratory (SAIL). She was a member of the Vehicle Integration Test Team at the 
Kennedy Space Center, and she served as a Spacecraft Communicator, or CAPCOM. 
Thornton holds a B.S. in Physics from Auburn University and an M.S. and Ph.D. in Physics 
from the University of Virginia. She was awarded a NATO Postdoctoral Fellowship to 
continue her research at the Max Planck Institute for Nuclear Physics in Heidelberg, West 
Germany. She was then employed as a physicist at the 
Technology Center in Charlottesville, Virginia. 


Mr. William Wegner 

Consultant 

Mr. Wegner graduated from the U.S. Naval Academy 
in 1948. He then received M.S. degrees in Naval 
Architecture and Marine Engineering from Webb Institute 
in New York. In 1956, Admiral Hyman Rickover selected 
Wegner to join the Navy’s nuclear program, and he was 
sent to MIT, where he received his M.S. in Nuclear 
Engineering. After a number of field positions, including 
Nuclear Power Superintendent at the Puget Sound Naval 
Shipyard, Wegner served for 16 years as Deputy Director 
to Admiral Rickover in the Naval Nuclear Program. He 
received Distinguished Service Awards from both the 
Defense Department and the Atomic Energy Commission. 

In 1979, Wegner retired from government service and 
formed Basic Energy Technology Associates with three fellow naval retirees. During its 10 
years of successful operation, the firm provided technical services to over 25 nuclear utilities 
and other nuclear-related activities. Wegner has served on a number of panels, including one 
of the National Academy of Sciences that studied the safety of Department of Energy nuclear 
reactors. From 1989 to 1992, he provided technical assistance to the Secretary of Energy on 
nuclear matters. He has supplied technical services to over 50 nuclear facilities. Wegner 
served on the Detroit Edison Board of Directors, 1990-1999. 
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Mr. Vincent D. Watkins 

Executive Secretary, Return to Flight Task Group 

Mr. Watkins has devoted his entire career, now 25 years, to the U.S. space program. Prior to 
his current position, he was Assistant Chief of the Flight Equipment Division in the Johnson 
Space Center’s Safety and Mission Assurance Directorate. He managed assurance activities 
related to the definition, design, development and operation of government-furnished 
equipment (GFE) and extravehicular activity equipment. These engineering functions 
included flight readiness verification, risk assessments, hazard analysis, nonconformance 
tracking and product delivery. In 2003 Watkins served as Executive Officer to the Chief of 
Staff at NASA Headquarters. During this assignment in the Office of the Administrator, he 
was instrumental in developing and implementing several key initiatives, including the 
Columbia Families First Team and the Columbia Accident Rapid Reaction Team. Watkins 
joined NASA in 1980 as Control System Engineer on the Shuttle Training Aircraft. From 
1997 to 2003, he served as Chief of the Flight Equipment Division’s GFE Assurance Branch. 
At UCLA in 2003, he completed a NASA Fellowship on Creativity and Innovation in the 
Organization. He was an inaugural member of the JSC Leadership Development Program in 
2002. He received the Mark D. Heath Aircraft Engineering Award, the NASA Exceptional 
Service Medal and numerous NASA Group Achievement Awards. Watkins has a B.S. in 
Mathematics from Albany State University. 


Colonel Michael J. Bloomfield, U.S. Air Force 

Astronaut Office Operations Officer, NASA 

Colonel Bloomfield is a NASA astronaut who has logged more than 753 hours in space. The 
Space Shuttle veteran was a crewmember aboard Atlantis in 1997, Endeavour in 2000 and 
Atlantis in 2002. A Shuttle Commander and Pilot, he has served as Director of Shuttle 
Operations, Chief Instructor Astronaut, and Chief of Safety in the Astronaut Office. He was 
Astronaut Representative to the Columbia Accident Investigation Board. Before entering 
training at the Johnson Space Center in 1995, Bloomfield served as test pilot for all models of 
the F-16 at Edwards Air Force Base, as well as Safety Officer and Flight Commander for the 
416th Flight Test Squadron. From 1983 until 1991, he served as a combat-ready pilot and 
instructor pilot in the F-15. He completed the F-15 Fighter Weapons Instructor Course and 
was honored as a Distinguished Graduate of the U.S. Air Force Test Pilot School. In 1983 he 
won the Commanders Trophy as Top Graduate from Air Force Undergraduate Pilot Training. 
Bloomfield holds a B.S. in Engineering Mechanics from the U.S. Air Force Academy and an 
M.S. in Engineering Management from Old Dominion University. He was also 1980 Captain 
of the U.S. Air Force Academy Falcon Football Team. 
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APPENDIX C - RTF TG STAFF 


Name 

Role 

Affiliation 

Shannon K. Bach 

Administrative Support 

Valador, Inc. Consultant 

Thomas E. Diegelman 

IVASP Support 

NASA Johnson Space 
Center 

David B. Drachlis 

Public Affairs Officer 

NASA Marshall Space 
Flight Center 

Maj. Gen. Joe H. Engle, 

U.S. Air National Guard (Ret.) 

Task Group Support 

Engle Technologies 

Malise M. Fletcher 

Technical Panel Support 

NASA Johnson Space 
Center 

Paula B. Frankel 

Recorder 

Westover and 
Associates, Inc. 

Lillian M. Hudson 

Travel Coordinator 

Valador, Inc. Consultant 

Dennis R. Jenkins 

Task Group Support 

Valador, Inc. Consultant 

Jennifer L. LeStourgeon 

Information Technology 

NASA Johnson Space 
Center 

Mario Loundermon 

Report Cover Artist 

Valador, Inc. 

Sharon J. Martin 

Budget Manager 

Al-Razaq Computing 
Services 

Susan E. Mauzy 

Task Group Support 

NASA Johnson Space 
Center 

Lt. Col. George E. “Ned” Mueller, 
U.S. Marine Corps (Ret.) 

Management Panel Support 

Valador, Inc. Consultant 

Lester A. Reingold 

Report Editor 

Valador, Inc. Consultant 

Anna K. “Kitty” Rogers 

Project Manager 

Valador, Inc. 

Susan K. Stone 

Travel Coordinator 

Valador, Inc. Consultant 

Barbara J. Teague 

Operations Panel Support 

NASA Johnson Space 
Center 

Tamara R. West 

Administrative Support 

NASA Johnson Space 
Center 
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Discovery mated to 
ET-120 in the 
Vehicle Assembly 
Building at the 
Kennedy Space 
Center; anomalies 
with this ET 
eventually forced the 
program to switch to 
ET-121 for STS-114. 
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APPENDIX D - RTF TG FACT-FINDING ACTIVITIES 

June 2003 


June 10, 2003 

NASA Headquarters, RTF TG Charter. 

June 24, 2003 

Johnson Space Center, RTF TG Meeting with Managers for Space 
Shuttle and International Space Station. 

August 2003 


August 5-7, 2003 

Kennedy Space Center, Plenary Meeting. 

August 18, 2003 

Johnson Space Center, NASA-National Geospatial-Intelligence 
Agency (NGA) Memorandum of Agreement (MoA). 

August 19-20, 2003 

Johnson Space Center, discussions with Space Shuttle Program, 
USA, and Boeing Management. 

August 21, 2003 

Videoconference, Space Flight Leadership Council Meeting. 

August 25, 2003 

Kennedy Space Center, Ground-based Imagery Discussions. 

August 27, 2003 

Lockheed Martin Missiles and Fire Control, Dallas, Texas, 
Reinforced Carbon-Carbon Non-Destructive Inspection. 

August 28, 2003 

Michoud Assembly Facility (MAF), External Tank Return to 
Flight Status. 

September 2003 


September 9-11, 2003 

Johnson Space Center, Plenary Meeting. 

September 17, 2003 

House Science Committee Members and Senior Staff visit. 



Charles G. 
Stevenson of the 
Kennedy Space 
Center (foreground) 
briefs staff and 
members of the 
Return to Flight Task 
Group during an 
August 5, 2003 visit 
to the Columbia 
Debris Hangar at the 
Kennedy Space 
Center. 
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September 17, 2003 

Senate Committee on Commerce, Science and Transportation 
Members and Senior Staff visit. 

September 18, 2003 

Johnson Space Center, Extravehicular Activity Tile and Reinforced 
Carbon-Carbon Repair. 

September 23, 2003 

NASA Headquarters, CAIB Recommendation 9.1-1 Fact-Finding. 

September 24, 2003 

Kennedy Space Center, Foreign Object Debris (FOD) and 
Non-Destructive Inspection. 

September 30, 2003 

Michoud Assembly Facility, External Tank Return to Flight Status. 

October 2003 



October 3, 2003 
October 8, 2003 

October 14, 2003 

October 20, 2003 
October 20, 2003 
October 22-23, 2003 
October 27-28, 2003 


Videoconference, Space Flight Leadership Council Meeting. 

Kennedy Space Center, Waivers and Deviations for Kennedy 
Space Center Ground Support Equipment. 

Washington, D.C., NASA-National Geospatial-Intelligence 
Agency (NGA) Memorandum of Agreement (MoA). 

Kennedy Space Center, Ground-based Imaging. 

House Science Committee Senior Staff visit. 

Ogden, Utah, Program Managers Review. 

NASA Headquarters, Submarine Safety Colloquium. 


Frank Benz of the 
Johnson Space 
Center in Houston, 
briefs members of 
the Return to Flight 
Task Group’s 
Technical Panel on 
the reinforced 
carbon-carbon 
(RCC) impact test rig 
during a fact-finding 
visit to the Southwest 
Research Institute in 
San Antonio, Texas 
on October 29, 2003. 
Task Group 
members and 
supporting staff are, 
from left, Sy 
Rubenstein, 
Astronaut Carlos 
Noriega, Rob 
Hammond, and Ben 
Cosgrove. 
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Return to Flight Task 
Group Technical 
Panel members and 
support staff inspect 
the External Tank 
planned for the 
STS-114 mission 
during a December 
2, 2003 fact-finding 
visit to the Michoud 
Assembly Facility 
near New Orleans. 
Lockheed Martin 
Space Systems 
Company’s Michoud 
Operations builds 
the External Tank for 
NASA at the facility. 


October 28-30, 2003 

October 29-30, 2003 
October 31, 2003 
November 2003 
November 5-30, 2003 

November 12, 2003 
November 20, 2003 
November 20, 2003 

November 21, 2003 

December 2003 

December 3-4, 2003 

December 2, 2003 
December 3, 2003 
December 9-10, 2003 


Johnson Space Center and Southwest Research Institute, San 
Antonio, Texas, Thermal Protection System Meetings. 

Cape Canaveral, Florida, Service Life Extension Program Summit. 

Teleconference, Atlantis Nosecap Non-Destructive Inspection. 

Marshall Space Flight Center, SRB Bolt-Catcher Critical Design 
Review. 

Johnson Space Center, JAXA Fact-Finding. 

Johnson Space Center, Management Meetings. 

Johnson Space Center, Mission Management Team Normal 
Accident Theory. 

Johnson Space Center, Space Flight Leadership Council Meeting. 

Johnson Space Center, Mission Management Team Simulation 
(Flight 12A.1). 

Michoud Assembly Facility, External Tank Status. 

Kennedy Space Center, Digital Closeout Imagery. 

Johnson Space Center, Plenary Meeting. 
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December 11-12, 2003 Marshall Space Flight Center, Space Shuttle Certification Status 
Review. 

December 16, 2003 NASA Headquarters, Space Flight Leadership Council Meeting. 

January 2004 

January 15, 2004 Johnson Space Center, STS-114 Flight Techniques Panel. 

January 22, 2004 Teleconference, Regarding R3.4-1, R3.4-2, R3.4-3, Imagery and 

R6.4-1, TPS Inspection and Repair with Mr. Steve Wallace (CAIB 
member). 

January 26, 2004 Teleconference, with Bryan O’Connor, Chief Safety and Mission 

Assurance Officer Regarding CAIB Recommendation 9.1-1. 

January 27, 2004 Teleconference, Jim Halsell Regarding Planning Framework for 

STS-114 and STS-121. 

January 28-30, 2004 Kennedy Space Center, SEIO Summit II. 

January 29, 2004 Johnson Space Center, Sub-nominal Bond Technical Interchange 

Meeting. 

February 2004 

February 2, 2004 Teleconference, ADM Harold W. Gehman (CAIB Chairman) 

February 3, 2004 Michoud Assembly Facility, External Tank Mini-Technical 

Interchange Meeting. 

February 3, 2004 Integrated Vehicle Assessment Sub-Panel, Organizational Telecon. 

February 4, 2004 Johnson Space Center, DTO 848 Preliminary Design Review. 

February 2-5, 2004 Kennedy Space Center, Launch and Landing Imagery Program 

Requirements Document Requirements Review. 

February 4, 2004 NASA Headquarters, ITEA Meeting. 

February 5, 2004 Johnson Space Center, STS-114 Joint Operations Panel #9 

Telecon. 


February 6, 2004 Kennedy Space Center, Solid Rocket Booster Thermal Protection 

System Mini-Technical Interchange Meeting. 

February 10, 2004 Johnson Space Center, Imagery Technical Interchange Meeting. 

February 11, 2004 Johnson Space Center, Mission Management Team Simulation. 

February 12, 2004 Teleconference, with Johnson Space Center MER Personnel 

Regarding SIMS Database. 

February 12-13, 2004 Johnson Space Center, Debris Summit II Summit. 
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February 17-18, 2004 Galveston, Texas, SLEP II Summit. 

February 18, 2004 NASA Headquarters, JAXA Fact-Finding. 

February 19, 2004 Johnson Space Center, Space Flight Leadership Council Meeting. 

February 19, 2004 Johnson Space Center, STS-114 Joint Operations Panel #10 

Telecon. 

February 18-19, 2004 Johnson Space Center, NASA-NGA MoA Meeting. 

February 20, 2004 Johnson Space Center, Integrated Vehicle Assessment Sub-Panel 

Meeting. 

February 24-25, 2004 NASA Headquarters, Management Panel Meetings. 

March 2004 

March 4, 2004 Johnson Space Center, STS-114 Joint Operations Panel #11 

Telecon. 

March 11, 2004 Kennedy Space Center, FOD and Digital Closeout Imagery. 

March 23-24, 2004 Johnson Space Center, OBSS Status Meeting. 

March 30, 2004 Johnson Space Center, STS-114 Joint Operations Panel #12 

Telecon. 

March 31, 2004 Sandia Labs, Albuquerque, New Mexico, OBSS Status Meeting. 

April 2004 

April 1, 2004 Kennedy Space Center, External Tank Monthly Review. 

April 2, 2004 Kennedy Space Center, Two-Person Closeout, Orbiter Hardening, 

and RCC Non-Destructive Inspection Briefings. 

April 2, 2004 Kennedy Space Center, Pre-Launch Mission Management Team 

Simulation. 


April 9, 2004 Kennedy Space Center, Two-Person Closeout, Orbiter Hardening, 

and RCC Non-Destructive Inspection Dry Run Briefings. 

April 12-15, 2004 Johnson Space Center, Plenary Meeting. 

April 28-30, 2004 Marshall Space Flight Center, SRB Bolt Catcher Delta Critical 

Design Review. 

May 2004 

May 14, 2004 Kennedy Space Center, Foreign Object Debris and Digital 

Closeout Imagery Status Review. 

May 19, 2004 Marshall Space Flight Center, SRB Bolt Catcher Critical Design 

Review Pre-board. 
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May 26, 2004 
May 27, 2004 

May 27, 2004 

June 2004 

June 8-9, 2004 

June 9, 2004 
June 10, 2004 
June 14-15,2004 

June 17, 2004 

June 22, 2004 

June 23, 2004 

June 25, 2004 


Johnson Space Center, Mission Management Team Simulation #5. 

Johnson Space Center, Reinforced Carbon-Carbon Plug Repair 
Preliminary Design Review. 

Marshall Space Flight Center, SRB Bolt Catcher/NSI Pressure 
Cartridge Critical Design Review. 


Johnson Space Center, LDRI Orbiter Inspection System Critical 
Design Review. 

Ogden, Utah, Space Flight Leadership Council Meeting. 

Ogden, Utah, Engineering Test Motor Firing at ATK-Thiokol. 

Kennedy Space Center, Systems Engineering & Integration Office 
Summit. 

Johnson Space Center, Operations Panel Fact-Finding Telecon 
with Space Shuttle Program regarding CAIB Recommendation 
6.4-1. 

Langley Research Center, Virginia, Management Panel visit to the 
NASA Engineering and Safety Center regarding CAIB 
Recommendations 6.2-1, 7.5-1, and 7.5-2. 

NASA Headquarters, Management Panel visit regarding CAIB 
Recommendations 6.2-1, 7.5-1, and 7.5-2. 

Michoud Assembly Facility and Stennis Space Center, External 
Tank Monthly Review. 


A full-scale Reusable 
Solid Rocket Motor is 
fired at ATK Thiokol 
Propulsion Division’s 
Promontory, Utah, 
test facility on June 
10, 2004. This motor 
tested modifications 
designed to enhance 
the safety and 
integrity of the Space 
Shuttle. Members of 
the Return to Flight 
Task Group 
observed the test 
during a fact-finding 
visit to the facility. 
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Return to Flight Task 
Group Management 
Panel members and 
staff meet with NASA 
officials during a fact¬ 
finding meeting in 
Washington, D.C. 
June 23, 2004. 


June 28, 2004 
June 29, 2004 
June 30, 2004 

July 2004 

July 1, 2004 

July 8, 2004 

July 8, 2004 

July 16, 2004 
July 21, 2004 

July 26-27, 2004 

July 27-28, 2004 
July 27-28, 2004 


July 28, 2004 


Johnson Space Center, Tile Test Article Review. 

Kennedy Space Center, SIMS Production Tool Demonstration. 

Kennedy Space Center, Mission Management Team 
Simulation #6. 


NASA Headquarters, NASA Administrator’s Retreat on Agency’s 
Space Shuttle Return to Flight. 

Kennedy Space Center, Operations Panel Fact-Finding on Space 
Shuttle Program-3, Contingency Shuttle Crew Support. 

Kennedy Space Center, Fact-Finding on CAIB Recommendations 
4.2-5 and 10.3-1. 


Teleconference, Fact-Finding on CAIB Recommendation 3.2-1. 

Teleconference, Plenary for Conditional Closures to CAIB 
Recommendations 4.2-5 and 10.3-1. 

Johnson Space Center, Reinforced Carbon-Carbon Test Article 
Review. 

Johnson Space Center, Mission Management Team Simulation #7. 

Johnson Space Center, Integrated Vehicle Assessment Sub-Panel 
Fact-finding Meeting with Simulation Planning Team, Mission 
Management Team training community, and System Engineering 
and Integration Office on Thermal Protection System Integrated 
Operations Plan. 

Johnson Space Center, Technical Panel Fact-finding with Space 
Shuttle Program on Integrated Risk Assessment for CAIB 
Recommendation 3.2-1. 
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August 2004 

August 10, 2004 

August 10-12, 2004 

August 13, 2004 
August 16, 2004 

August 18, 2004 

August 18-19, 2004 

August 25, 2004 
August 30, 2004 

August 30-3, 2004 
August 31-1, 2004 

September 2004 

September 1, 2004 

September 3, 2004 
September 13, 2004 
September 13, 2004 

September 14-16, 2004 
September 22-23, 2004 

October 2004 

October 5-6, 2004 
October 08, 2004, 

October 19-20, 2004 


Kennedy Space Center, Operations Panel Fact-finding on Space 
Shuttle Program-3, Contingency Shuttle Crew Support. 

Johnson Space Center, Space Shuttle Program Impact Testing and 
Debris Summit. 

Johnson Space Center, R6.4-1 Strategy Session. 

Teleconference, Internal Review of CAIB Recommendation 4.2-1 
Closure. 

Johnson Space Center, Fact-Finding with Space Shuttle Program 
on CAIB Recommendations 6.3-1 and 7.5-3. 

Kennedy Space Center, External Tank TPS Certification Technical 
Interchange Meeting. 

Kennedy Space Center, External Tank Monthly Review. 

Kennedy Space Center, Management Panel and Operations Panel 
Fact-finding with Space Shuttle Program Workforce. 

Michoud Assembly Facility, ET Flange Critical Design Review. 

Johnson Space Center, Orbiter Boom Sensor System Design 
Review. 


Marshall Space Flight Center, Space Flight Leadership Council 
Meeting. 

Teleconference, Debris Summit Debrief. 

Johnson Space Center, Tile Repair System Design Review. 

Johnson Space Center, Integrated Vehicle Assessment Sub-Panel 
Fact Finding on TPS Integrated Operations Plan. 

Johnson Space Center, Plenary Meeting. 

Johnson Space Center, On-Orbit Mission Management Team 
Simulation. 


Ogden, Utah, RCC Plug Repair Technical Interchange Meeting. 

Washington, D.C., Meeting with OMB, OSTP, and White House 
staff. 

Marshall Space Flight Center, RCC Crack Repair Preliminary 
Design Review. 
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October 20-21, 2004 Michoud Assembly Facility, ET TPS Certification Technical 
Interchange Meeting. 


October 25-26, 2004 

October 27, 2004 

October 28, 2004 
October 28-29, 2004 
October 29, 2004 
November 2004 
November 8-10, 2004 


Kennedy Space Center, Ground Camera Ascent Imagery Project 
Critical Design Review. 

Teleconference, on Verification, Validation and Certification 
Definitions. 

NASA Headquarters, RTF TG Leadership Meeting. 

Johnson Space Center, RTF Flight Operations Progress Review. 
Videoconference, Space Flight Leadership Council Meeting. 


Johnson Space Center, Space Shuttle Program Impact Testing 
Debris Summit. 


November 9-10, 2004 Michoud Assembly Facility, External Tank TPS Certification 

Status Briefing. 


November 15, 2004 

November 16, 2004 


Johnson Space Center, Management Panel Briefing to the 
Aerospace Safety Advisory Panel. 

Johnson Space Center, Management Panel Fact Finding on 
CAIB Recommendation 6.3-1. 


November 16-18, 2004 Marshall Space Flight Center, SRB Bolt Catcher Design 

Certification Review Onsite Documentation Review. 



Return to Flight Task 
Group members and 
staff inspect the 
Space Shuttle 
External Tank being 
prepared for the 
STS-114 mission 
during a visit to the 
Michoud Assembly 
Facility in New 
Orleans November 
10, 2004. 
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November 16-19, 2004 Johnson Space Center, STS 114 On-Orbit Mission Management 

Team Simulation. 


November 18, 2004 Telecon with Space Shuttle Program on CAIB recommendation 

R3.3-2. 


November 22, 2004 Johnson Space Center, Space Shuttle Program Presents R3.3-2 and 

4.2-1 Closures to Technical Panel/Integrated Vehicle Assessment 
Sub-Panel. 


November 23, 2004 NASA Headquarters, Deputy Chief Engineer Presents R7.5-1 and 

R9.1-1 Closures. 


November 30, 2004 Johnson Space Center, Space Shuttle Program Presents R3.4-1, 

R3.4-2, R3.4-3 Closures to Operations Panel and Integrated 
Vehicle Assessment Sub-Panel. 


November 30-1, 2004 Johnson Space Center, RCC Plug Repair Technical Interchange 

Meeting #3. 

November 30, 2004 Marshall Space Flight Center, SRB Bolt Catcher Design 

Certification Review Pre-Board. 


December 2004 

December 2, 2004 Johnson Space Center, Cure-In-Place Ablator (CIPA) 

Critical Design Review. 

December 3, 2004 Marshall Space Flight Center, SRB Bolt Catcher Design 

Certification Review Board. 


Return to Flight Task 
Group Management 
Panel Lead Dr. Dan 
L. Crippen, left, 
confers with 
Technical Panel 
Lead Joseph W. 

Cuzzupoli during a 
December 2004 fact¬ 
finding plenary at the 
Marshall Space 
Flight Center in 
Huntsville, Alabama. 
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December 9, 2004 Videoconference, Space Flight Leadership Council Meeting. 

December 10, 2004 Marshall Space Flight Center, SRB Bolt Catcher Design 

Certification Review Delta Board. 

December 13, 2004 Johnson Space Center, Integrated Vehicle Assessment Sub-Panel 
Fact Finding on TPS Integrated Operations Plan. 

December 14-15, 2004 Marshall Space Flight Center, Plenary Meeting. 

December 15, 2004 Johnson Space Center, Space Shuttle Program Fact Finding on 

CAIB Recommendation 6.4-1. 

January 2005 

January 7, 2005 Johnson Space Center, Orbiter Return to Flight Working Group - 

Down Select for Repair Option Meeting. 

January 10-14, 2005 Johnson Space Center, Debris Summit. 

January 13, 2005 Johnson Space Center, Program Requirements Control Board - 

Down Select for Repair Option. 

January 21, 2005 Kennedy Space Center, Imagery Technical Interchange Meeting . 

January 24, 2005 Michoud Assembly Facility, External Tank Design Certification 

Review II. 

January 26-27, 2005 Johnson Space Center, R6.4-1 Fact Finding. 

January 27, 2005 Johnson Space Center, Component Simulation. 

February 2005 

February 2-3, 2005 Johnson Space Center, Japanese Space Agency (JAXA) Fact- 

Finding. 

February 7-10, 2005 Johnson Space Center, Orbiter Delta Design Certification Review. 

February 8, 2005 Washington, D.C., Imagery Technical Interchange Meeting. 

February 15, 2005 Teleconference Plenary for Conditional Closure of CAIB 

Recommendation 3.3-1. 

February 18, 2005 Videoconference, Space Flight Leadership Council Meeting. 

February 22-23, 2005 Kennedy Space Center, Systems Design Certification Review II. 

February 24-25, 2005 Michoud Assembly Facility, ET Design Certification Review II 

Pre-Board. 


February 25, 2005 Johnson Space Center, Component Simulation. 

February 25, 2005 Johnson Space Center, RCC On-Orbit Crack Repair Gun Critical 

Design Review. 
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Return to Flight Task 
Group Technical 
Panel members and 
staff observe Space 
Shuttle Solid Rocket 
Booster stacking 
operations in the 
Vehicle Assembly 
Building during a 
February 22, 2005, 
fact-finding visit to 
the Kennedy Space 
Center, Florida. 



February 28-March 7, 
2005 

March 2005 

March 8-9, 2005 

March 10, 2005 

March 15, 2005 

March 15, 2005 
March 21, 2005 

March 22, 2005 

March 24, 2005 

March 28, 2005 

March 29, 2005 

March 29-31,2005 


Kennedy Space Center and Johnson Space Center, STS-114 
On-Orbit Mission Management Team Simulation. 


Michoud Assembly Facility, ET Design Certification Review I 
and II Board. 

Johnson Space Center, Space Shuttle Program Closure 
Presentation to Operations Panel and the Integrated Vehicle 
Assessment Sub-Panel on Space Shuttle Program-3, Contingency 
Shuttle Crew Support. 

Johnson Space Center, Space Shuttle Program Closure 
Presentation to Technical Panel and Integrated Vehicle Assessment 
Sub-Panel on CAIB Recommendation 3.2-1, ET Debris Shedding. 

Washington, D.C., Meeting with Congressman Calvert and Staff. 

NASA Headquarters, Management Panel Closure Discussion on 
CAIB Recommendations 9.1-1, 6.2-1, and 6.3-1. 

Johnson Space Center, Operations Panel Fact Finding with Mr. 
Wayne Hale, Deputy Space Shuttle Program Manager on Space 
Shuttle Program-3, Contingency Shuttle Crew Support. 

Johnson Space Center, Space Shuttle Program Closure 
Presentation Telecon with Technical Panel and Integrated Vehicle 
Assessment Sub-Panel on CAIB Recommendation 3.3-2. 

Johnson Space Center, Management Panel Splinter Session on 
Space Shuttle Program Closure Packages for CAIB 
Recommendations 9.1-1, 6.2-1, and 6.3-1. 

Johnson Space Center, Integrated Vehicle Assessment Sub-Panel 
Splinter Session on Final Report Comments. 

Johnson Space Center, Plenary Meeting. 
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April 2005 


April 4, 2005 

Johnson Space Center, Stafford Task Force/Anfimov AEC Fact 
Finding. 

April 4, 2005 

NASA Headquarters, RTF TG Meeting. 

April 5, 2005 

Jet Propulsion Laboratory, California, RTF TG to ASAP 

Transition Meeting. 

April 6, 2005 

Johnson Space Center, System Design Certification Review II 
Board. 

April 7-8, 2005 

Teleconference, Operations Panel Mission Management Team 
Training Fact-Finding. 

April 7-9, 2005 

Johnson Space Center, System Design Verification Review III 
(Debris) Board. 

April 12, 2005 

Teleconference, Space Shuttle Program Fact Finding on Certificate 
of Flight Readiness Process. 

April 13, 2005 

Johnson Space Center, RCC Repair Interim Design Review. 

April 19, 2005 

Kennedy Space Center, Program Design Certification Review. 

April 20, 2005 

Washington, D.C., RTF TG Co-Chair and Management Panel Lead 
Meeting with Congressmen Gordon and Udall and Staff. 

April 20, 2005 

Washington, D.C., RTF TG Co-Chair and Management Panel Lead 
Meeting with House Science Committee Staff. 

April 25, 2005 

Johnson Space Center, CAIB Recommendation 6.4-1 Fact Finding. 

April 26-27, 2005 

Johnson Space Center, Delta System Design Verification Review 

III (Debris). 

April 26-28, 2005 

Johnson Space Center, Operations Integration Plan Simulation #3 
Flight Day 04-06. 

May 2005 


May 3-4, 2005 

Michoud Assembly Facility, Monte Carlo Inputs Review of 
External Tank Debris Data. 

May 4, 2005 

Johnson Space Center, Mission Management Team Simulation 
#13, Contingency Shuttle Crew Support. 

May 9, 2005 

NASA Headquarters, RTF TG Co-Chair Meeting with NASA 
Administrator. 

May 10, 2005 

Johnson Space Center, Review of Debris Transport Validation. 

May 11,2005 

Johnson Space Center, Orbiter Impact and Damage Tolerance 
Models for RCC and Tile. 
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May 12, 2005 

Johnson Space Center, R6.4-1 Closure Discussion with Space 
Shuttle Program. 

May 18, 2005 

Michoud Assembly Facility, Foam Divot-Transport-Impact 
Damage Technical Interchange Meeting. 

May 24, 2005 

Johnson Space Center, Ice Technical Interchange Meeting. 

May 25, 2005 

Johnson Space Center, Unexpected Debris Review Foam Divot- 
Transport-Impact Damage Technical Interchange Meeting. 

May 26, 2005 

Johnson Space Center, Aerospace Corp. Go/No-Go Decision for 
Monte Carlo Analysis. 

June 2005 


June 2-3, 2005 

Johnson Space Center, Debris Design Verification Technical 
Review Dry-Run. 

June 6-7, 2005 

Johnson Space Center, Plenary Meeting. 

June 15, 2005 

Johnson Space Center, R6.4-1 Closure Data Review. 

June 16-17, 2005 

Johnson Space Center, Debris Verification Technical Review 

Dry Run. 

June 20, 2005 

Michoud Assembly Facility, Bellows Heater Design Certification 
Review. 

June 22, 2005 

Johnson Space Center, STS-114 Delta Safety and Mission 
Assurance Readiness Review. 

June 23, 2005 

Kennedy Space Center, Delta Systems Design Certification 
Review. 

June 24, 2005 

Kennedy Space Center, Final Debris Design Verification Review. 

June 25, 2005 

NASA Headquarters, R3.2-1 and R3.3-2 Closure Data Review. 

June 27, 2005 

NASA Headquarters, Plenary Meeting. 

June 28, 2005 

NASA Headquarters, RTF TG Co-Chairmen and Panel Leads 
Meeting with NASA Administrator. 

July 2005 


July 1,2005 

Johnson Space Center, Japanese Space Agency (JAXA) Fact- 
Finding. 
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APPENDIX E - ACRONYMS 


AFB 

AFRSI 

ASAP 

ATOTS 

BFS 

BST 

C-SiC 

CAD 

CAIB 

CDR 

CIA 

CIPA 

CIPAA 

C02 

CSCS 

DCR 

DFO 

DOAMS 

DoD 

DTO 

DVR 

ECLSS 

EFM 

EPOCC 

ET 

EVA 

FACA 

FOD 

FRCS 

HDTV 

HQ 

HSC 

HSDT 

HST 

JSC 

ICB 

ISS 

ITA 

ITAR 

IVA 

IVASP 

KSC 

KTM 

LCC 

L02/L0X 

LH2 

LON 

MAF 

MAS 

MER 

MMT 

MoA 

MPP 

MR 


Air Force Base 

Advanced Felt Reusable Surface Insulation (TPS blankets) 
Aerospace Safety Advisory Panel 
Advanced Transportable Optical Tracking System 
Backup Flight System (Orbiter avionics) 

Behavioral Science Technology, Inc. 

Carbon-Silicon Carbide 

Computer-Aided Design 

Columbia Accident Investigation Board 

Critical Design Review 

Central Intelligence Agency 

Cure In-Place Ablator 

CIPA Applicator 

Carbon Dioxide 

Contingency Shuttle Crew Support 
Design Certification Review 
Designated Federal Official (FACA) 

Distant Object Attitude Measurement System 

Department of Defense 

Development Test Objective 

Design Verification Review 

Environmental Control and Life Support System 

Equivalent Flow Model (Scheduling tool) 

Expanded Photographic Optic Control Center 

External Tank 

Extra-Vehicular Activity 

Federal Advisory Committee Act 

Foreign Object Debris 

Forward Reaction Control System 

High Definition Television 

Headquarters 

House Science Committee 

High Speed Digital Television 

Hubble Space Telescope 

Johnson Space Center (Texas) 

Integration Control Board 
International Space Station 
Independent Technical Authority 
International Traffic in Arms (Federal law) 

Intra-Vehicular Activity 

Integration Vehicle Assessment Sub-Panel 

Kennedy Space Center (Florida) 

Kineto Tracking Mount 
Launch Commit Criteria 
Liquid Oxygen 
Liquid Hydrogen 
Launch-on-Need 

Michoud Assembly Facility (Louisiana) 

Manifest Assessment System (scheduling tool) 

Mission Evaluation Room 
Mission Management Team 
Memorandum of Agreement 
Material Processing Plan 
Material Review 
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MRB 

Material Review Board 

MSFC 

Marshall Space Flight Center (Alabama) 

NASA 

National Aeronautics and Space Administration 

NESC 

NASA Engineering and Safety Center 

NDE 

Non-Destructive Evaluation 

NDI 

Non-Destructive Inspection 

NGA 

National Geospatial-Intelligence Agency (formerly NIMA) 

NIMA 

National Imagery and Mapping Agency (now NGA) 

NOAX 

Non-Oxide Adhesive experimental 

NSI 

NASA Standard Initiator 

NSTS 

National Space Transportation System (Space Shuttle) 

02 

Oxygen 

OBSS 

Orbiter Boom Sensor System 

OIP 

Operations Integration Plan 

OMM 

Orbiter Major Modifications 

OMDP 

Orbiter Modification and Down Period 

OMRS 

Operation and Maintenance Requirements System 

ORM 

Orbiter Repair Maneuver 

OV-102 

Columbia 

OV-103 

Discovery 

OV-104 

Atlantis 

OV-105 

Endeavour 

PAL 

Protuberance Air Load (ramps on ET) 

PASS 

Primary Avionics Software System (Orbiter avionics) 

PDL 

Polymer Development Laboratories (TPS foam) 

PDR 

Preliminary Design Review 

POCS 

Photographic Optic Control System 

PR 

Problem Report 

PRCB 

Program Requirements Control Board 

PRR 

Production Readiness Review 

PTS 

Pad Tracker System 

RCC 

Reinforced Carbon-Carbon 

RFI 

Request for Information 

RPM 

R-bar Pitch Maneuver 

RSRM 

Reusable Solid Rocket Motor (propulsion part of SRB) 

RTF TG 

Return to Flight Task Group 

SDTV 

Standard Definition Television 

SEIO 

Systems Engineering and Integration Office (also SE&IO) 

SFLC 

Space Flight Leadership Council 

SiC 

Silicon Carbide 

SIMS 

Shuttle Image Management System 

SMA 

Safety and Mission Assurance 

SRB 

Solid Rocket Booster 

SRMS 

Shuttle Remote Manipulator System 

SSME 

Space Shuttle Main Engine 

SSP 

Space Shuttle Program 

SSPO 

Space Shuttle Program Office 

SSRMS 

Space Station Remote Manipulator System 

STS 

Space Transportation System (Space Shuttle) 

TPS 

Thermal Protection System 

TZM 

Titanium, Zirconium, Molybdenum (metal alloy) 

USA 

United Space Alliance 

WAVE 

WB-57 Ascent Video Experiment 

WLE 

Wing Leading Edge (on Orbiter) 
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Discovery being 
lifted to a vertical 
position in the 
transfer aisle of the 
Vehicle Assembly 
Building at the 
Kennedy Space 
Center. After the 
Orbiter is vertical, it 
will be lifted into one 
of the high bays to 
be mated with a 
waiting stack of Solid 
Rocket Boosters and 
an External Tank. 
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Discovery hangs in 
the transfer aisle of 
the Vehicle 
Assembly Building at 
the Kennedy Space 
Center. The two 
green squares are 
the undersides of the 
umbilical well doors; 
after the External 
Tank separates, 
these doors close 
over the areas just 
outboard of them. 
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ANNEX A - INDIVIDUAL MEMBER OBSERVATIONS 

During two years of fact-finding, some members of the Task Group made observations that 
they believe should be brought to the attention of the NASA Administrator as he leads the 
Agency past the return to flight. Those observations, which are not related to the safety or 
operational readiness of STS-114, are presented in this annex. These are not Task Group 
observations but rather represent the views of the individual authors; where additional Task 
Group members have chosen to support these views, they are so identified. 

A.l Observations by Maj. Gen. William A. Anders 

1. NASA’s response to the CAIB findings and the Agency’s support of the RTF TG: 

I believe that NASA as a whole has made a commendable effort in these regards. It has 
not been perfect or totally efficient, but that should be understandable for such a massive 
Agency-wide challenge coming out of the shock of the Columbia accident. 

2. Safety of Human Spaceflight and Space Shuttle operations: The Space Shuttle is a 
high-performance vehicle with thin margins as is necessary to support the very 
challenging field of human space flight. NASA has done a commendable job in 
addressing the issues raised by the CAIB report to the extent such issues can be addressed 
practicably. Nonetheless, the Space Shuttle will never be particularly safe. If the United 
States chooses to operate in this demanding environment, we need to be continually alert 
to minimize risk and be sure it is worth the gain. And, we should not be too surprised if 
or when another accident happens. 

3. America’s “vision” and NASA’s strategy for space exploration and exploitation: It is 

desirable and unavoidable that humans will explore and exploit space. The major 
questions are: how, and at what pace? A key necessity for implementing any successful 
strategy/vision is that the scope and pace be in balance with the available resources. This 
seems to have been forgotten or ignored by both the Executive and Legislative branches. 
Over the past four decades NASA has experienced an almost continuous series of cost 
overruns and performance short-falls; the Space Shuttle has been the “poster child” for 
this phenomenon. Apollo was established to demonstrate to Americans and the rest of the 
world that the United States was not a second-rate power as had been strongly suggested 
by Sputnik , Gagarin, and the “missile gap.” It was a jingoistic program during the height 
of the Cold War that was strongly supported by the American (tax-paying) public. That 
program was successfully demonstrated on July 19, 1969, when Neil Armstrong and 
Buzz Aldrin planted an American flag at Tranquility Base. Unfortunately, NASA and a 
host of space enthusiasts incorrectly assumed (hoped?) that America’s political will and 
financial support extended beyond that necessary to “beat the Soviets” (Apollo 11 and 
prior). These enthusiasts continued intense and expensive exploitation and exploration 
programs (e.g. up to Apollo 17, Space Shuttle, the International Space Station ...) while 
political and financial support waned. These ambitious new programs, coupled with the 
political necessity to maintain the Apollo-derived NASA infrastructure (Centers), put the 
Agency’s scope in serious imbalance with its resources. Such is still the case. Until hard 
choices are made to bring the Agency’s scope (the Vision for Space Exploration) into 
balance with its resources, we should not be surprised by future mishaps and short-falls in 
our currently over-stressed human space flight programs. Since it is not likely that the 
American public will provide Apollo-like support for the current vision, it seems that its 
scope and pace should be reduced to more realistic levels (balance). 

4. Make-up of the RTF TG: In my view, the Task Group was too large to carry out its 
charter effectively and efficiently. In addition, it would have been advisable to slant the 
talents of the Task Group members more toward those with experience in accident 
investigation, large-program management, and human space flight. 
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A.2 Observations by Dr. Dan L. Crippen, Dr. Charles C. Daniel, 

Dr. Amy K. Donahue, Col. Susan J. Helms, Ms. Susan Morrisey 
Livingstone, Dr. Rosemary O’Leary, and Mr. William Wegner 

Taken one-at-a-time, the RTF TG assessments of the NASA implementation of the CAIB 
retum-to-flight recommendations may leave an impression of accomplishment that we believe 
does not present a comprehensive picture of NASA’s return-to-flight effort. Without a doubt, 
we share with NASA the same fervent desire to see the Space Shuttle Program successfully 
continue as a healthy, vibrant tribute to the achievements of human spaceflight. To this end, 
although it was not within the explicit charter of the Return To Flight Task Group, we have 
documented additional observations relevant the post -Columbia environment that we believe 
are important to share with NASA leadership to help them address what we perceive to be 
continuing challenges. This is not a set of conclusions, but is a detailed summary of persistent 
cultural symptoms we observed throughout the assessment process. 

We agree that the improvements to the Space Shuttle and its organization are real, and often 
significant. This is a tribute to the dedicated efforts of many people working hard at all levels 
and in all parts of the Agency. At the same time, we believe that the leadership and 
management climate that governed NASA’s return-to-flight effort was weak in some 
important ways that bear discussion. While we explicitly address the Space Shuttle return-to- 
flight effort, we believe these organizational and behavioral concerns are still pervasive 
throughout the human spaceflight programs. 

These observations are not intended as criticism of the entire NASA workforce. We have 
stated several times - in this report and elsewhere - that within the “working levels,” much of 
the NASA and contractor workforce “got it” and we believe at least some have always gotten 
it. And, indeed, there are some capable leaders at NASA who also “get it.” 

Our observations also are not meant to diminish the achievements made in addressing the 
individual CAIB recommendations. The workforce performed to the best of its ability, often 
with little direction. We commend their efforts and recognize their accomplishments. We also 
believe, however, that leadership and managerial shortfalls generally made the retum-to-flight 
effort more complicated, more costly, and lengthier than it needed to be. 

The Rogers Commission and the Columbia Accident Investigation Board (CAIB) reports are 
both rich in explanation of factors that have weakened NASA’s ability to effectively manage 
a high-risk program. Yet while NASA leadership was focused on the 15 CAIB retum-to-flight 
recommendations, they missed opportunities to address the enduring themes of dysfunctional 
organizational behavior that the CAIB and other external evaluators have repeatedly found. 
As a result, in our view, many fundamental concerns persist. Our intent here is to present 
some of the most prominent of these that we observed. 

The advantage of hindsight, and the opportunity to second-guess decisions made since 
February 2003, permeates these observations. All of them were, however, written prior to the 
launch of STS-114. It is also important to recognize that the behaviors and attitudes described 
here were not chance occurrences that were observed only once or twice, but that emerged 
numerous times throughout the Task Group’s interactions with NASA. The intent of these 
observations is to help NASA leadership identify and rectify these concerns. We will address 
four main areas: rigor, risk, requirements, and leadership. At the conclusion of our discussion, 
we cite specific examples to support and clarify our observations. 

Rigor 

“Rigor” refers to the scmpulous adherence to established standards for the conduct of work. 
In NASA’s context, the safe and reliable execution of high-risk, complex technical endeavors 
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requires the rigorous and consistent understanding of, and adherence to, standard process. 
These processes should be enforced across all projects and elements, and preferably even 
across programs. Implementing standard processes across programs allows more consistent 
evaluations of the programs, and eases the transition of personnel moving from one program 
to another. As we observed them, the return-to-flight activities often demonstrated a lack of 
standard processes, and, in some cases, simply a lack of any process at all. 

One dilemma the Agency faced in this regard was how to communicate about its goals and 
standards of achievement. Once the Agency is on record as committed to a specific 
achievement, it becomes unpalatable to back off of that target for fear of appearing to fail. 
Instead, the adjustment of performance standards to allow a “best-effort” provides the 
appearance that the goal has been met, but without the rigor and discipline necessary do so 
safely or completely. Before making commitments to specific achievements, NASA should 
fully consider how much progress is feasible, and motivate public and private expectations 
accordingly. When achievements are mandatory at first but become “goals” when the going 
gets tough, it sends a strong message to everyone that nothing is mandatory. 

With the benefit of hindsight, the Agency’s unquestioned endorsement of, and commitment to 
comply with, the CAIB return-to-flight recommendations may have been laudable and 
reasonable - and perhaps even necessary under the circumstances the Agency faced at the 
time - but it may also have been a mistake. The endorsement of the CAIB recommendations, 
before conducting a thorough engineering and programmatic assessment of their implications, 
short-circuited a more traditional and rigorous process. NASA has long maintained a list of 
the hardware risks to the vehicle, and had an upgrades program in place before the Columbia 
accident. Ideally, NASA should have determined the importance of the CAIB 
recommendations in relation to the risks and upgrades it was already tracking. Then leaders 
should have prioritized the implementation of the CAIB recommendations against other 
desired risk mitigation efforts to determine the best expenditure of limited program resources 
to provide the largest reduction in overall risk. 

The change in National Policy dictating the Space Shuttle be retired in 2010 presented the 
Agency with an opportunity to re-evaluate the decision to fully implement all of the CAIB 
recommendations and to curtail actions that were proving to be unproductive or inefficient; 
NASA did not. 

In our view, NASA leadership should not have foregone their traditional process of 
conducting detailed assessments of proposed changes. The CAIB recommendations were 
important, but the accident board fully acknowledged that they had not considered their 
recommendations within the larger context of the Space Shuttle Program. In addition, before 
committing to a short-term launch date - that ultimately drove any number of important 
implementation decisions - NASA should have conducted detailed engineering assessments 
of the CAIB recommendations, traded them against other risk mitigation efforts, developed a 
clear understanding of the physics of foam loss, and devoted serious consideration of 
alternatives to “fix the foam;” e.g., Orbiter hardening or a redesigned External Tank. This 
would have allowed the program to determine how long a stand-down was necessary to 
implement a reasonable set of requirements to reduce the risk of flying the vehicle. 

As we reviewed the return-to-flight effort, it was apparent that there were numerous instances 
when an opportunity was missed to implement the best solution because of this false schedule 
pressure. As early as September 2003 the RTF TG was told that specific technical activities 
were not being performed because they could not meet the schedule. Too often we heard the 
lament: “If only we’d known we were down for two years we would have approached this 
very differently...” 

This overall lack of integrated planning resulted in ad hoc and redundant efforts. Even the 
NASA Implementation Plan disappoints: it has no document number, no change history, and 
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no clear place in the program’s effort. Its subtitle - “A periodically updated document 
demonstrating our progress ...” - makes clear that it is not an executable “plan” but, instead, a 
status report. Many of the lower-level “plans” that were presented in formal meetings were 
developed after implementation was initiated, instead of setting clear objectives and 
acceptance criteria before the work was begun. Activities were undertaken without an 
understanding of how they contributed to the overall retum-to-flight effort and without any 
sense of budgetary or other limits. As a result, at the end of 2-!4 years and $1.5 billion or 
more, it is not clear what has been accomplished. 

While solving the technical problems associated with return to flight was always seen as the 
highest priority, the cost associated with accomplishing this was for the most part neither 
effectively monitored nor managed. In fact, many of the retum-to-flight efforts were initiated 
at mid- to lower-levels with little visibility or traceability to the Space Shuttle Program level 
(Level II). These factors have combined to allow for uncontrolled cost growth and an overall 
lack of cost management. If the return-to-flight effort had been better managed to control 
costs, it is possible that funding would exist to upgrade the Orbiter with newer systems and 
eliminate risks posed by hardware not involved in the Columbia accident. 

We also observed that instead of concise engineering reports, decisions and their associated 
rationale are often contained solely within Microsoft PowerPoint® charts or emails. The CAIB 
report (Vol. I, pp. 182 and 191) criticized the use of PowerPoint as an engineering tool, and 
other professional organizations have also noted the increased use of this presentation 
software as a substitute for technical reports and other meaningful documentation. PowerPoint 
(and similar products by other vendors), as a method to provide talking points and present 
limited data to assembled groups, has its place in the engineering community; however, these 
presentations should never be allowed to replace, or even supplement, formal documentation. 

Several members of the Task Group noted, as had CAIB before them, that many of the 
engineering packages brought before formal control boards were documented only in 
PowerPoint presentations. In some instances, requirements are defined in presentations, 
approved with a cover letter, and never transferred to formal documentation. Similarly, in 
many instances when data was requested by the Task Group, a PowerPoint presentation 
would be delivered without supporting engineering documentation. It appears that many 
young engineers do not understand the need for, or know how to prepare, formal engineering 
documents such as reports, white papers, or analyses. 

Another disturbing trait that we observed was that personalities were allowed to dominate 
over strict process - examples exist of strong personalities attempting to avoid process and 
others allowing avoidance to occur. Many in senior leadership observed these lapses in 
process, but did little to correct the situation. For example, during the System Design 
Certification Review (DCR) II on February 23, 2005, a senior program manager commented 
that, “It is no longer an important question as to whether or not any given item is certified. 
Some things won’t be certified ... Items don’t have to be certified to fly, and we can even get 
waivers for the safety cert if need be.” It was astounding that there was no rebuttal to this 
statement, even though the individual was not the most senior person at the table. This 
mocking of rigor sends a message to junior staff that it is acceptable to modify or avoid 
established processes. As a result, both organizational and individual accountability fell by the 
wayside. Senior leadership should not trivialize established processes since their attitudes can 
be infectious, either to the benefit or detriment of the Space Shuttle Program and the Agency. 

Risk 

The CAIB report (Vol. I, p. 193, F7.4-3) states: “Over the last two decades, little to no 
progress has been made toward attaining integrated, independent, and detailed analyses of risk 
to the Space Shuttle System.” In terms of the propensity to accept cumulative risk, the CAIB 
noted (Vol. I, p. 139): “These little pieces of risk add up until managers are no longer aware 
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of the total program risk, and are, in fact, gambling.” Throughout the retum-to-flight effort, 
we observed these propensities still exist. 

Very few human endeavors, particularly related to high energy activities involving advanced 
technologies, are completely free of risk. Spaceflight in general and human spaceflight in 
particular, is such that it is impossible to drive the risk to zero. Most who have led high risk, 
technical organizations will readily admit one of the greatest threats resides is unknown, 
unrecognized, or unacknowledged risks. Ultimately, all three of NASA’s human spaceflight 
mishaps resulting in crew loss fell prey to one or more of these. To eliminate these threats, 
successful risk management approaches mandate thorough, ongoing, and critical assessments 
of potential individual and systemic vulnerabilities. While the return to flight efforts may have 
reduced some known risks, Space Shuttle missions will always be “accepted risk” operations. 
NASA must be vigilant to prevent the development of a false sense of security by accepting 
faulty assumptions, or otherwise inappropriate analyses, to justify continued Space Shuttle 
missions. The vehicle is not inherently unsafe, but it demands a high degree of vigilance to fly 
safely. 

Unfortunately, we do not believe the risk management processes in place within the Space 
Shuttle Program are sufficiently robust. One telling sign is the program’s development of a 
document entitled, The Integrated Risk Acceptance Approach For Return To Flight , which 
was revised several times during early 2005. This narrative has little substance regarding 
classical risk management. It is more a brief status report on a list of known and significant 
risks, noting where risk has been “accepted,” with no rationale or explanation. The document 
exhibits the very lack of accountability we referenced previously: it does not have an official 
document number, has no change history, appears not to be under configuration management, 
lists no authors, and has no approval signatures. The Task Group was informed that this 
document did not reflect the complete integrated risk acceptance for the return to flight, but to 
our knowledge, a total integrated risk acceptance rationale was never provided to the Task 
Group. 

We note that NASA managers also tend to confuse the exhaustive and laudable Integrated 
Hazard Report system with integrated risk management. The Space Shuttle Program has 
executed a thorough review of all Integrated Hazard Reports on its own initiative and at a 
considerable cost in hours and funds. As commendable as this effort has been, the review of 
thousands of Integrated Hazards does not constitute, nor should it be a substitute for, a 
comprehensive integrated risk management approach. 

Throughout the retum-to-flight effort, there has been a reluctance to appropriately 
characterize the risks inherent in the Space Shuttle Program. As an example, it has proven 
irresistible for some officials to characterize the modified External Tank as “safer,” the “safest 
ever,” or even “fixed,” when neither the baseline of the “old” tanks nor the quantitative 
improvement of the “new” design has been established. The tank may well be safer, but 
without adequate risk assessment based on objective evidence it is impossible to know. 

The CAIB noted (Vol. I, pp. 118, 189-190, 200) that as the Space Shuttle became 
“operational,” NASA did not sustain the rigorous risk identification, assessment, management 
capabilities, or mindset required for what in reality was a developmental vehicle operating in 
a high-risk environment. Prior flight history became, incorrectly, an accepted risk rationale. In 
the end, few human spaceflight activities are more important than identifying and assessing 
the residual risk to flight and determining if it is acceptable from both a cumulative and 
integrated perspective. It is axiomatic that a fundamental capability of a “high-risk” agency is 
the ability to analyze risk, and failure to do so rigorously is a failure of leadership. 

It is ironic that the Space Shuttle will need to be treated as a developmental vehicle even as 
the program is winding down toward retirement; the risks of the last flight will be every bit as 
great as the risks for each of the flights before it. History has shown that leadership has 
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occasionally, but boldly, made the wrong choices and has been too easily convinced that the 
risk is acceptable. For the future of manned spaceflight, NASA leadership must protect 
against such tendencies. 

Requirements 

The Space Shuttle Program does not seem to have a basic understanding of what requirements 
are, what they can do for the program, and what they can do to the program. In many cases 
during the return-to-flight effort, hardware was built or modified, and models or analysis tools 
were coded and used, before any requirements were generated. This was explained by one 
program official as, “... if this were ‘business as normal’ ... we would follow the classic 
approach of defining requirements first. Return to flight is not in that mode, if we want to fly 
anytime soon.” The fact was, they didn’t fly anytime soon, partly because they did not have 
adequate requirements. The same program official continued, “We are pushing for answers on 
RCC vulnerability, test results on debris allowables, best available resolution for imagery - 
best effort across the board - without really knowing what the requirements are.” We are not 
convinced that implementing changes to man-rated systems without first defining 
requirements is a desirable approach. The lack of requirements also partially explains the 
difficulties the program has in determining how to verify, validate, and certify the new 
capabilities, and how to adequately determine how much remaining risk needs to be accepted. 

The discipline of defining integrated requirements before embarking on implementation 
allows an overall picture of work to be done, including associated interdependencies. This in 
turn facilitates prioritization of those requirements and therefore also prioritization of tasks to 
be done. Had this been accomplished, NASA would have been in better position to determine 
which tasks should have been constraints to the return to flight and which should not. This 
would also have allowed the development of proper schedules and plans, the generation of 
reasonable budget and resource estimates, and their allocation as established by priorities. As 
it was, it seemed that when it became apparent that a particular function would not be 
completed before return to flight (e.g., TPS repair), the program simply decreed that it was no 
longer mandatory for STS-114. 

Because of this lack of discipline, the Space Shuttle Program experienced instances where 
flight hardware was manufactured, accepted, and manifested prior to the completion of design 
reviews and the release of approved engineering documentation. Major testing and design 
activities were undertaken without specific requirements or success criteria. In some cases, 
the program simply refused to write down requirements, citing the “work” as more important 
than documentation. Lacking specific direction from the program, working-level personnel 
proceeded to perform test, design, and analysis activities based on their best guess of what 
was required. This resulted in designs that failed to meet the requirements that were ultimately 
written, tests that did not apply to the actual environments, models based on flawed 
assumptions, and a general expenditure of resources in an uncoordinated manner. 

It is recognized that even with correctly-written requirements, non-conformances will exist on 
either a temporary or permanent basis. These non-conformances need to be documented, 
completely assessed, and formally presented to management for a determination if the 
requirement should be changed, waived, or if it should be met as-stated and the non¬ 
conformance eliminated. Although a process exists to manage this, it is not rigorously 
followed in all instances. 

The Space Shuttle Program has been repeatedly cited for having too many waivers, and has 
become reluctant to add additional waivers, choosing instead to “beat” the system by using 
other means. Evidence of this involved open work on the External Tank despite its generally 
rigorous process. Numerous open items came out of the External Tank DCR. Instead of 
capturing each one of these as a separate piece of open work, the ET Project announced at the 
February 24-25, 2005, DCR pre-board that it would document them in a “Verification 
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Limitations Document.” While it is laudable that the project at least captured the deficiencies 
in the certification (unlike some others), the stated rationale for this approach was that the 
Verification Limitations Document would negate the need for any waivers. This, in effect, 
clouds the number of requirements that are not being met and diminishes the certification of 
the External Tank. 

The Use of Models 

As part of the retum-to-flight effort, NASA initiated the development of a suite of more than 
20 new models to assist in assessing both pre- and post-launch risk. Standard engineering 
practice calls for objectives (requirements and interface definitions) to be established prior to 
development for any model or system of models, and processes and criteria defined for 
validating and verifying the model’s results. Also, it is not unusual for a peer review by 
outside experts to be employed, especially to evaluate systems of complex models that are by 
necessity inter-related but do not naturally resolve themselves to systemic specification. 
Initially, we did not observe these normal processes being followed during the development 
of these models, and a formal request by Ralph Roe of the NESC for a stand-down to evaluate 
the completed works was ignored. Later the NESC and other organizations did undertake 
limited peer reviews. 

In the case of debris analysis, models for: 1) debris liberation; 2) aerodynamic characteristics 
of the debris; 3) transport analysis of debris; 4) impact tolerance of the thermal protection 
system; and, 5) the resultant thermal and structural models of the effects of damage, are all 
necessary to assess risk. The uncertainties in one model (or system) inherently feeds into and 
compounds the uncertainty in the second model (or system), and so on. It appears, however, 
that NASA largely designed these five classes of models without the attention to the 
interdependencies between the models necessary for a complete understanding of the end-to- 
end result. Understanding the characteristics of, and validating and verifying, one type of 
model without examining the implications for the end-to-end result is not sufficient. 

Further compounding the modeling challenge is the fact that the models most often used for 
debris assessment are deterministic, yielding point estimates, without incorporating any 
measure of uncertainty in the result. Methods exist to add probabilistic qualities to the 
deterministic results, but they require knowledge of the statistical distribution of the many 
variables affecting the outcome. Typically, the distributions of the “independent” variables 
would be derived from empirical observation. In the case of spaceflight, however, empirical 
evidence is often limited or non-existent, so theoretical or engineering distributions must be 
substituted. The probabilistic analysis therefore is very dependent on the quality of the 
assumptions made by the developers. Although they evaluated some of the assumptions used 
by the model developers, the NESC end-to-end “peer review” primarily analyzed whether the 
output of one model could be incorporated into the next, not the joint probability associated 
with any given output ... without which it is difficult to know the reliability of the result. 

Probability distributions are analytic methods necessary when assessing risk. Without an 
understanding of the likelihood of an outcome, risk acceptance is a judgment based on instinct 
and experience. But, as the Columbia accident showed, in a high risk environment that 
involves many unknowns like human space flight, experience and instinct are poor substitutes 
for careful analysis of uncertainty. This requires that analytical models be used appropriately 
to inform decisions within a rigorous engineering process. 

Leadership 

Leadership is critical to the success of any organization of the size and complexity of NASA. 
Without leadership the organization lacks cohesiveness and its goals lack coherence, resulting 
in wasted resources and, potentially, compromised products. A true leader is one who 
creates/coerces/compels/attracts/demands a responsive organization. It is never enough for a 
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leader to say: “I made that decision, what more do you want me to do?” Instead, at NASA, 
leaders must follow through to ensure decisions are executed with the rigor and discipline 
necessary for safe human spaceflight. 

Nonetheless, what our concerns about rigor, risk, and requirements point to are a lack of 
focused, consistent, leadership and management. What we observed, during the retum-to- 
flight effort, was that NASA leadership often did not set the proper tone, establish achievable 
expectations, or hold people accountable for meeting them. On many occasions, we observed 
weak understanding of basic program management and systems engineering principles, an 
abandonment of traditional processes, and a lack of rigor in execution. Many of the leaders 
and managers that we observed did not have a solid foundation in either the theory or practice 
of these basic principles. As the CAIB noted (Vol. I, p. 223, 010.12-1), “Unlike other sectors 
of the Federal Government and the military, NASA does not have a standard agency-wide 
career planning process to prepare its junior and mid-level managers for advanced roles.” In 
fact, NASA’s early successes are rooted in program management techniques and disciplines 
that few current managers in the human spaceflight arena have been willing to study. As a 
result, they lack the crucial ability to accurately evaluate how much or how little risk is 
associated with their decisions, particularly decisions to sidestep or abbreviate any given 
procedure or process. 

It is essential that senior managers have previously-demonstrated program management and 
systems engineering skills and a dedication to well-established, rigorous principles as they 
apply to complex, geographically and organizationally dispersed programs. More to the point, 
we remain concerned that NASA senior leadership did not recognize or correct this, and 
indeed sent contrary signals that the rigor and discipline of a sound program management 
process was not required. 

The Role of Accountability 

A crucial factor in creating a responsive and responsible organization is accountability. 
Within the human spaceflight programs, the lack of accountability appears to be pervasive, 
from the failure to establish responsibility for the loss of Columbia , up to and including a 
failure to require an adequate risk assessment of the next flight. While accountability takes 
many forms, to inculcate an organization and its culture with accountability requires, at a 
minimum, the consistent setting of expectations, as well as appropriate consequences for not 
meeting them. This is an important role of a leader. If no one, or no part of the organization, is 
held accountable for failing to meet those expectations, performance becomes simply a case 
of “best effort” - a term that became common during many retum-to-flight discussions. 

A general attitude within the Space Shuttle Program seems to be that best-effort is a 
satisfactory substitute for meeting specific technical requirements; often requirements were 
not even documented to avoid the chance they could not be met. However, best-effort is a 
very poor substitute for a thorough understanding of the technical situation. Parts of the 
Agency seem to have forgone their traditional engineering rigor in favor of “when you have 
done your best effort, you are good to go.” This is not an appropriate philosophy for a high- 
performance organization that routinely puts the lives of its employees into high-risk 
situations. As Richard Feynman pointed out in his appendix to the Rogers Commission report, 
“... reality must take precedence over public relations, for nature cannot be fooled.” 

Although not described as such, the CAIB noted many of the symptoms of an organization 
operating with a best-effort attitude. The accident board wrote, “... traits and organizational 
practices detrimental to safety were allowed to develop, including: reliance on past success as 
a substitute for sound engineering practices (such as testing to understand why systems were 
not performing in accordance with requirements); organizational barriers that prevented 
effective communication of critical safety information and stifled professional differences of 
opinion; lack of integrated management across program elements; and the evolution of an 
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informal chain of command and decision-making processes that operated outside the 
organization’s rules” (CAIB, Vol. I, p. 9). Yet we witnessed the best-effort approach during 
the retum-to-flight effort; we saw it in the NASA responses to Task Group requests for 
information (RFI), observed it during briefings, and experienced it while processing the 
closure packages sent to us by the Space Shuttle Program. 

Since NASA leadership had few rigorous requirements or expectations for CAIB compliance, 
the closure packages, which should have represented the auditable, documented status of the 
NASA implementation of the CAIB recommendations, tended to rely on mass, rather than 
accuracy, as proof of closure. The closure packages showed an organization that apparently 
still believes PowerPoint® presentations adequately explain work and document 
accomplishments. Our frustration with these packages drew the response that the engineering 
teams able to provide the detail were too busy preparing for launch and “doing real work” to 
properly document their actions. The inadequate and disorganized closure packages 
frequently required significant effort to obtain even minimally essential documentation. The 
packages themselves were often provided prematurely presumably (and sometimes with direct 
request) to seek guidance on “what it would take” to get the Task Group to “pass the 
recommendation.” 

Individual accountability - what the Agency is now calling “technical conscience” - can 
overcome the best-effort malaise if accompanied with sufficient positive and negative 
consequences. Part of being accountable, providing more than best-effort, includes having a 
well thought-out, focused plan prior to beginning implementation. Technical conscience 
provides the impetus to carry out those plans with rigorous adherence to engineering 
discipline. We feel significant progress can be made if this new technical conscience can be 
spread throughout the Space Shuttle Program and the rest of NASA. 

Attitude and Learning 

The CAIB noted an air of “arrogance” within NASA that led leaders and managers to be 
dismissive of the views of others, both within the organization and, especially, from outside 
the Agency. A less critical way to describe the phenomenon is one of “comfort” - comfort 
with existing beliefs, comfort with past experience, and comfort with information developed 
inside NASA. As an excuse for not listening, especially to criticism from outside the agency, 
NASA often proclaims itself to be unique. We readily admit that few organizations of any 
type - governmental, academic, or commercial - do the kind of work NASA does. Although 
the end product may be different, however, many of the processes are not different from those 
found in many large organizations. Whatever the source of this apparent insularity, it is 
inappropriate for an agency that routinely operates in a high-risk environment. The recurrence 
of apparently preventable accidents and the seeming unwillingness to learn should be 
sufficient to instill some humility to temper what often looks like arrogance. During the past 
two years, we have not witnessed very much of such humility. 

During the return to flight effort, even while NASA was systematically encouraging everyone 
to speak up and many processes were opened to more participation, the result was still very 
much the same as before the accident - roles, positions, and strength of personality often 
determined critical outcomes more than facts and analysis. More people were talking, but not 
many more were listening. 

Not listening manifests itself in other ways. It appears to us that NASA, unlike most high- 
performance organizations, rarely studies its own, or anybody else’s, mistakes; the CAIB also 
commented on this trait (CAIB Vol. I, p.l 1). It is widely believed that organizations that study 
and learn from small mistakes can often avoid larger ones. Conversely, those who do not learn 
as they go have no experience base to help avoid the big mistakes - such as the Challenger 
and Columbia accidents. An organization that places little value on sustained improvement 
from prior mistakes will tend to repeat them and certainly will not effectively carry the 
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necessary lessons forward to other programs. We have seen little evidence of renewed 
commitment to learning lessons from past mistakes at NASA. 

For instance, while many academic and government entities use the Challenger accident as a 
case study, ironically the human spaceflight programs do not. Similarly, NASA scarcely 
considers lessons from other organizations involved in high-risk endeavors, such as the 
Navy’s courses on the Scorpion and Thresher submarine accidents and its SUBSAFE 
program. As stated in the CAIB Report, Chapter 7, “The submarine Navy has a strong safety 
culture that emphasizes understanding and learning from past failures. NASA emphasizes 
safety as well, but training programs are not robust and methods of learning from past failures 
are informal.” Although NASA has maintained a “lessons learned” system since 1992, the 
human spaceflight activities appear not to have embraced it. 

In addition to not being willing to leam from mistakes, many NASA managers are not willing 
to leam from success, either. NASA’s early successes, as well as many in DoD are rooted in 
program management techniques and disciplines that few managers in the human spaceflight 
arena have been willing to study. Having apparently not done so, they lack the ability to 
accurately evaluate how much or how little risk is associated with sidestepping or 
abbreviating any given procedure or process. 

Summary 

It is difficult to be objective based on hindsight, but it appears to us that lessons that should 
have been learned have not been. Perhaps we expected or hoped for too much. The CAIB 
report should have served NASA as a “wake-up” call. As the CAIB noted (Vol. I, p. 208), 
“The recognition of human spaceflight as a developmental activity requires a shift in focus 
from operations and meeting schedules to a concern for the risks involved. Necessary 
measures include ... Barring unwarranted departures from design standards, and adjusting 
standards only under the most rigorous, safety-driven process.” 

We expected that NASA leadership would set high standards for post -Columbia work. We 
expected upfront standards of validation, verification and certification. We expected rigorous 
and integrated risk management processes. We expected involved and insightful leadership 
from NASA Headquarters. We were, overall, disappointed. 

There certainly are capable leaders to be found in the Space Shuttle Program and throughout 
NASA. In our view, though, the return-to-flight effort, when taken as a whole, was not 
effectively led or managed. The absence of accountability, of having managers dedicated to 
program management processes, and of managers being assigned to programs only after 
demonstrating these skills are what we believe to be the causes of the surface-level symptoms 
we saw so often. In particular, leadership and managerial failures to set expectations and 
requirements and a failure to hold people accountable; these promoted a lack of engineering 
rigor, discipline, and integrated risk assessment. Ultimately, this cost the program significant 
time and money while producing, in some areas, suspect, disappointing and/or inadequate 
results. Learning the lessons of these failures is important to NASA’s future. 

Conclusion 

Among the most damning observations CAIB made of NASA was the sense of complacency 
toward the problem of the External Tank shedding of foam. Despite program requirements 
that no debris should be shed, there were over 15,000 instances of damage to the Orbiter, most 
of which came from debris from the Space Shuttle elements. As has been widely reported, 
two flights before Columbia , a large piece of foam was shed and caused minor damage to one 
of the Solid Rocket Boosters. Photographic documentation was available of major foam 
shedding from the External Tanks on at least seven previous flights (CAIB Vol. I, p. 85). 
Despite all this evidence, foam had never destroyed an Orbiter and the program relied on this 
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“flight history” to justify inactivity before and during the flight of Columbia. 

This “We’ve seen this before” mentality is still present, and it appeared on more than one 
occasion during MMT simulations. In addition, leading up to the return-to-flight, the program 
justified not pursuing potential ice damage to the Orbiter umbilical doors because there had 
not been substantial damage on previous flights. Despite the evidence of impacts all around 
the area, the official rationale for accepting the risk was listed as “flight history;” i.e., we’ve 
never had critical damage there before. 

NASA’s leaders and managers must break this cycle of smugness substituting for knowledge. 
NASA must be able to quantify risk, even if imperfectly, set requirements and expectations, 
and hold organizations and individuals accountable, Analytical models - while valuable tools 
- cannot substitute for engineering judgment and conscience. Rigor must be reestablished 
throughout the Agency. Opinion, no matter how well informed, cannot replace objective 
evidence. Flight history, while critical for informed judgment, cannot substitute for it. “We’ve 
been lucky” is a statement that should never be associated with the human spaceflight 
programs. 

Perhaps most disturbing is the engineering legacy that seems to be developing within NASA. 
As with many professions, the basics of engineering are learned in school. However, good 
engineering practices - such as rigor in process and documentation - are learned outside the 
classroom in an apprentice-like environment. These practices are passed onto future 
generations as part of the “culture” of an organization. However, when an organization loses 
focus on its core values, the effects stretch far beyond the present because those principles are 
no longer passed onto future generations. Senior leaders do not appear to be concerned with 
following defined processes and are passing this legacy on to future leaders. 

In order to properly prepare the Agency for the future, including the return to the Moon and 
journey to Mars, we offer the following suggested actions, all of which must start at the top 
and flow down to the programs, projects, and workforce: 

1) Clearly set achievable expectations and hold people accountable; in addition to 
positive consequences, this includes negative consequences for not performing 
to expectations; 

2) Return to classic program management and systems engineering principles and 
practices (including integrated risk management), and execute these with rigor; 

3) Ensure managers at all levels have a solid foundation in these attributes before 
appointing them to such responsibilities; this requires not only training, but 
successful demonstration of these skills at a lower level; 

4) Eliminate the prejudices and barriers that prevent the Agency, and especially the 
human spaceflight programs, from learning from their own and others’ mistakes. 

NASA needs to learn the lessons of its past ... lessons provided at the cost of the lives of 
seventeen astronauts. 

Specific Examples 

The examples that follow this narrative are just that - examples. However, the behaviors and 
attitudes were not random events that were seen merely once or twice, but numerous times 
throughout the Task Group’s interactions with NASA. Many of the examples presented are 
not intended as detailed case studies, but are meant to provide evidence demonstrating 
behaviors of concern. We offer these observations for consideration and future improvement. 


Page 197 of 216 



Final Report of the Return to Flight Task Group 


Rigor Example 1 

From our vantage point, the process for selecting a launch date was flawed, if indeed there 
was a process. We understand these were not normal circumstances, and the usual processes 
used to establish launch dates - hardware processing templates and payload readiness, to 
name two - were not applicable. However, we feel that the establishment of launch dates that 
seemingly did not take into account the full ramifications of the analysis and development 
efforts being conducted ultimately proved detrimental to the program. 

As discussed in the narrative of this observation, we feel the program should have begun the 
retum-to-flight effort with a process that determined what work needed to be accomplish to 
return to flight, what the interdependencies were among that work, then develop schedules 
that supported the execution of the work. This process would have helped determine which 
efforts needed to be accomplished first since their results were required by other efforts. For 
example, determining the damage tolerance of the Orbiter before giving the ET Project their 
debris allowables requirements would have helped ensure the tank modifications would 
eliminate the appropriate debris. Establishing the RCC damage thresholds early would have 
provided the OBSS effort with their inspection criteria. 

Instead, it appears to us that senior management selected launch dates based on non-technical 
concerns, ultimately placing unnecessary and unrecoverable restrictions on teams working 
retum-to-flight hardware development. In addition, several important requirements - such as 
the critical damage and debris size - were scheduled to be finalized at FRR, far too late to 
influence the products being provided by the External Tank Project, OBSS, and other 
systems. In addition, the constant setting of a launch date only a few months away never 
allowed the development efforts to take full advantage of the ultimate two-year stand-down; 
we heard several times that different solutions to various problems would have been selected 
if launch had not been 90 days away. 


Scheduled Return-to-Flight Launch Dates 

Meeting Date 

STS-114 Launch Date 

Days Until Launch 

Months Until Launch 

Jan 29, 2003 

Mar 01,2003 

31 

1.0 

Feb 10, 2003 

Mar 01,2003 

19 

0.6 

Feb 11,2003 

Apr 03, 2003 

51 

1.7 

Feb 24, 2003 

Apr 03, 2003 

38 

1.3 

Feb 25, 2003 

Jul 21,2003 

146 

4.9 

Apr 16, 2003 

Jul 21,2003 

96 

3.2 

Apr 17, 2003 

Oct 01,2003 

167 

5.6 

May 21,2003 

Oct 01,2003 

133 

4.4 

May 22, 2003 

Dec 18, 2003 

210 

7.0 

Jul 28, 2003 

Dec 18, 2003 

143 

4.8 

Jul 29, 2003 

Mar 11,2004 

226 

7.5 

Oct 05, 2003 

Mar 11,2004 

158 

5.3 

Oct 06, 2003 

Sep 12, 2004 

342 

11.4 

Mar 08, 2004 

Sep 12, 2004 

188 

6.3 

Mar 09, 2004 

Mar 06, 2005 

362 

12.1 

Oct 28, 2004 

Mar 06, 2005 

129 

4.3 

Oct 29, 2004 

May 12, 2005 

195 

6.5 

Feb 15, 2005 

May 12, 2005 

86 

2.9 

Feb 16, 2005 

May 14, 2005 

89 

2.9 
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Apr 06, 2005 (SFLC) 

May 15, 2005 

39 

1.3 

Apr 19, 2005 (SFLC) 

May 22, 2005 

33 

1.1 

Apr 29, 2005 (HQ) 

July 13, 2005 

75 

2.5 

Jul 13, 2005 (scrub) 

July 16, 2005 

3 

0.1 

Jul 16, 2005 (HQ) 

July 26, 2005 

10 

0.3 


When a revised launch date was proposed to the Spaceflight Leadership Council in February, 
2005 for consideration, the briefing leading up to the decision only identified KSC processing 
timelines; no questions were asked regarding the ability of the elements to complete their 
work with adequate rigor in time to support this date; activities that were ongoing to support 
meeting the CAIB recommendations. Additionally, the debris/flight rationale requirements 
were discussed after the launch date was set, thereby never entering into the launch rationale. 

As we reviewed the path that NASA has taken to prepare for STS-114, it became apparent 
that there were numerous instances when an opportunity was missed to implement the best 
solution because of this false schedule pressure. Many times technical-level personnel 
indicated that if they had known that they were going to be grounded for 2 years, the solutions 
chosen would have been much different. The following examples illustrate how an unrealistic 
schedule for retum-to-flight compromised standard processes: 

1. A decision was made not to install L02 feedline bellows heaters on ET-120 (the 
first STS-114 tank) and ET-121 (the initial STS-121 tank, ultimately used on 
STS-114) despite evidence one might be required. Instead, only a relatively 
easy, but ultimately questionably effective, “drip lip” was installed on the first 
two tanks. Continued questions about its effectiveness eventually drove the 
program to roll-back STS-114 from the launch pad to install the heater. 

2. The implementation of the OBSS sensor package was selected before knowing 
the size of the damage that needed to be detected. In fact, as of July 11, 2005, 
the NSTS 60517, PRD for the Shuttle On-Orbit TPS Inspection System still had 
numerous TBDs for critical requirements regarding the required resolution 
capability. On several occasions, members of the NASA workforce have 
expressed that methods other than the OBSS would have been preferable and the 
OBSS was chosen due to the short time before the targeted launch date. 

3. The decision to stay with the STA-54 tile repair material was made on the 
apparent near-term availability of this material and not because anybody 
believed it was the best possible choice. 

4. Both Shuttle and ISS teams reworked flight manifests, schedules, and analysis 
many more times than should have been necessary due to this lack of an 
integrated approach to resolving the real issues and planning a realistic timeline 
to launch. This also resulted in repeated coordination with the international 
partners. 

True research and development (R&D) efforts - such as TPS repair - should not have been a 
constraint to the launch of STS-114 unless the Agency felt the capabilities to be provided by 
these R&D efforts were so important they could not risk lives without them. Additionally, 
NASA should have evaluated their return-to-flight activities and determined which efforts 
were not progressing as originally intended, then been completely honest with itself, higher 
authority, and the Task Group that they would not be able to meet those recommendations 
within the funding and schedule constraints imposed on the program. Schedules for R&D 
activities are difficult to predict, and perhaps should be the rationale to not include them as 
return-to-flight criteria. 
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Rigor Example 2 

On August 27, 2004, one year after the release of the CAIB report, the Space Shuttle Program 
signed PRCBD S062246 approving the Post-STS-107 Return-to-Flight Design Certification 
Review Plan and Procedures document, NSTS 60524. The proclaimed purpose of this 
document was to “define the activities and procedures for accomplishing the Space Shuttle 
Program (SSP) Design Certification Review (DCR) process for Retum-to-Flight after the 
Columbia accident. This plan establishes the requirements, responsibilities, preliminary 
schedule, general implementation guidelines, and success criteria required to complete the 
post-STS-107 RTF DCR process and document the review results.” 

This document directed a tiered DCR process to formally demonstrate that new or modified 
systems, software, supporting processes, and operations meet the program design, safety, 
performance, and operational requirements levied upon the item in question. The process also 
required demonstration that “appropriate certifications have been performed” at lower levels. 
The document specifically recognized that the “tiered DCR process being conducted for RTF 
is not classical in nature as more content than simple certification of hardware is reviewed. 
The SSP is utilizing this process to cover other major topics, such as standard operational and 
process changes, which would otherwise be discussed at a Flight Readiness Review (FRR).” 
The design to be certified during the DCR was to include all changes occurring after the STS- 
107 Certificate of Flight Readiness (CoFR) was signed on January 9, 2003. 

Ironically, the effect seems to have been largely the opposite. Instead of pulling FRR material 
forward into the DCRs, many of the projects/elements, and the program itself, stated during 
their DCRs that reviews of several activities would be deferred until the FRR. This seems too 
late in the process to be making critical decisions. 

In all, the 60-page document was an attempt to instill some discipline into the return-to-flight 
process. However, during fact finding, we noted that while a program-wide process for DCRs 
existed, it was not imposed on the various projects - each project and the Space Shuttle 
Program executed DCRs in different manners with wide variances in the scope, execution and 
rigor for the various project and system-level DCRs. In response to a question from a Task 
Group member on this wide variability, the Systems Engineering and Integration Office 
indicated they didn’t set any standard processes because MSFC and JSC operate differently - 
this from the organization that put together the DCR process originally. 

Additionally, a senior Space Shuttle Program official at one point denied the existence of a 
document governing the DCR process, despite the fact that he approved NSTS 60524. It is a 
concern that processes put in place specifically for the return-to-flight effort can be ignored so 
cavalierly without consequence. 

During early 2005, the program decided that since they would likely not be able to “certify” 
the debris aspects of the Space Shuttle system, the term Design Certification Review was no 
longer appropriate. Instead, a series of newly termed Design Verification Reviews (DVR) 
were held. These seemed to suffer a rough start; during the first DVR, when asked about the 
availability of data and documentation to support the review, the program responded that none 
was available. When asked about the success criteria for the review, the response from the 
program was that none had been established. Interestingly, NSTS 60524 was never updated to 
reflect the newly-coined DVR process. 

On one hand, the rigorous DCR process was ignored by many; on the other hand, there were 
too many of these reviews. Various parts of the program did not have all the necessary work 
completed in time for scheduled DCRs, so there ended up being multiple DCRs for each 
project/element to cover all the work. Rather than 12 System Reviews (6 DCRs and 6 DVRs - 
and none of these covered TPS repair), it likely would have been a better use of resources 
(particularly the reviewers’) to delay the System DCR/DVR until all the work was complete. 


Page 200 of 216 



Final Report of the Return to Flight Task Group 


The degree of rigor employed during the return to flight effort has varied with the individual 
projects. At the one extreme are activities like the SRB Bolt Catcher redesign and, to a lesser 
extent, the modifications to the External Tank thermal protection system. Both of these 
projects exhibited a formal and documented approach to the establishment of requirements 
and execution of their design review and certification processes. Both the SRB Bolt Catcher 
and the ET had formal plans for their various reviews, formal data packages, a formal issue 
review process, formal pre-boards and boards, and well-documented formal findings. 

The other extreme includes activities such as Orbiter TPS repair, which have been extremely 
convoluted. While presentation material for the repair efforts was developed for the Orbiter 
DCR II held in February 2005, the material was not covered at that meeting. At the System 
DCR II later that month, it was stated that repair techniques would not be addressed in the 
DCR/DVR process, because there were no Level II requirements to have a repair capability. 
This was even though the DCR process was supposed to cover all changes since the STS-107 
CoFR, criteria that certainly applied to the repair techniques. 

Perhaps the most revealing behavior observed during the design reviews was at the Program 
DCR at KSC on April 19, 2005. This “review,” like many witnessed during the return-to- 
flight effort, was not so much a review as it was a status briefing. No technical questions were 
asked by the Board; no technical responses given. With the single exception of the SSME 
Project, each project and element simply presented a high-level summary of their current 
status, including open work; SSME attempted to describe a technical problem and request 
help in resolving it, without much success. The final certification was conditional on the 
“satisfactory completion of identified open work,” but nobody before, during, or after the 
meeting kept track of the open work presented by the projects/elements. This meeting 
validated the CAIB observation of engineering and decisions via PowerPoint presentation 
rather than technical detail and rigor. 

Risk Example 1 

The Space Shuttle Program has, in the past, too often accepted risks that should have been 
mitigated; this trend appeared to continue during the retum-to-flight effort. It appears to us 
that what the CAIB wrote (Vol. I, p. 193, F7.4-5) is still applicable today: “Risk information 
and data from hazard analyses are not communicated effectively to the risk assessment and 
mission assurance processes. The Board could not find adequate application of a process, 
database, or metric analysis tool that took an integrated, systemic view of the entire Space 
Shuttle system.” 

Ultimately, few programmatic responsibilities are more important than identifying and 
assessing risk and determining if it is acceptable from both a cumulative and integrated 
perspective. As the Space Shuttle became “operational,” NASA did not sustain the risk 
identification, assessment, management capabilities, or mindset required for what in reality 
was a developmental vehicle operating in a high-risk environment. Prior flight history became 
an accepted risk rationale. The perceived risk level during the launch of STS-107 was not 
aligned with the facts regarding the actual debris environment, just as the perceived risk for 
Challenger had not been aligned with the true state of the o-rings. Nevertheless, the issues 
were considered accepted risks that had potentially catastrophic consequences, but with a 
remote likelihood of occurrence. Despite this perception, in reality the risks should have been 
considered unacceptable - potentially catastrophic consequences with a good likelihood of 
occurrence. 

This should have initiated a design change, either to eliminate the debris environment or to 
modify the Orbiter to withstand the resulting debris environment, in accordance with the 
Space Shuttle Hazard Reduction Precedence Sequence (NSTS 5300.4[lD-2] Section 1D201, 
Item 6, based on MIL-STD-882D, Section 4.4). This program-wide policy has as its first step, 
design action to eliminate the hazard: 
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Hazard Reduction Precedence Sequence. To eliminate or control hazards, the contractor 
shall use as a minimum the following sequence or combination of items: 

a. Design for Minimum Hazard. The major goal throughout the design phase shall 
be to ensure inherent safety through the selection of appropriate design features 
as fail operational/fail safe combinations and appropriate safety factors. 
Hazards shall be eliminated by design where possible. Damage control, 
containment and isolation of potential hazards shall be included in design 
considerations. 

b. Safety Devices. Known hazards which cannot be eliminated through design 
selection shall be reduced to an acceptable level through the use of appropriate 
safety devices as part of the system, subsystem, or equipment. 

c. Warning Devices. Where it is not possible to preclude the existence or 
occurrence of a known hazard, devices shall be employed for the timely 
detection of the condition and the generation of an adequate warning signal. 
Warning signals and their application shall be designed to minimize the 
probability of wrong signals or of improper personnel reaction to the signal. 

d. Special Procedures. Where it is not possible to reduce the magnitude of existing 
or potential hazard through design, or the use of safety and warning devices, 
special procedures shall be developed to counter hazardous conditions for 
enhancement of ground and flight crew safety. Precautionary notations shall be 
standardized. 

It is recognized that any design change takes time to develop, implement, and certify; 
however, the specific design action could be underway while the program assesses the 
technical risk of continuing operations and maintains a focused awareness of the risk in each 
area. The program should not have the option of short-circuiting the process by skipping to 
“accepted risk” as was done before both Challenger and Columbia. 

The goal is to change the design to completely eliminate the risk. As with all design actions - 
especially when dealing with high technology programs such as spaceflight - it is recognized 
that there will be limitations driven by the laws of physics and program resources. The Space 
Shuttle has a finite life (scheduled to be retired in 2010) and no program has, or will have, 
infinite resources. The best available technical solution should be sought without regard to 
schedule and resources limitations; these will come into play when the proposal is formally 
brought before program management (i.e., the PRCB). The modification should be installed at 
the earliest opportunity to remove the risk; however, in the interim, procedural mitigations 
could be used to minimize the risk of continuing to fly if an acceptable-risk rationale can be 
developed. This is the approach we expected to see in the Integrated Risk Acceptance 
Approach For Return To Flight , but did not. 

Every risk (non-conformance) should be documented, have a documented rationale for 
limited acceptance, and a documented risk retirement plan with the objective of completely 
eliminating the risk. Again, it may not be feasible to retire all risk, but it is important for 
NASA to develop an understanding of what is involved in the resolution of non-conformances 
and the retirement of risk. 

We do not feel that the program is currently using this process to mitigate or accept risks. For 
example, it took the current NASA Administrator’s personal intervention during a technical 
review held shortly after his appointment to force appropriate recognition by program 
management that the well known and recognized ice shedding from the External Tank was, in 
fact, potential critical debris and should be treated as such. His further direction finally forced 
the slip of STS-114 to the July 2005 launch window in order to incorporate necessary 
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technical control measures (i.e., the forward L02 feedline bellows heater). Absent the 
Administrator’s direct action, STS-114 might very well have launched with the physical cause 
of Columbia's loss (ET bipod ramp foam) fixed, but with an identified, yet unacknowledged, 
risk to vehicle and crew. 

NASA should return to compliance with its long-established procedures for addressing risks. 
There are enough risks in the “unknown-unknowns” without unnecessarily increasing risk by 
not promptly and rigorously resolving the “known-knowns” and “known-unknowns.” 

Risk Example 2 

We do not believe the risk assessment processes in place within the Space Shuttle Program 
are sufficiently robust. One telling sign is the program’s development of a document entitled, 
The Integrated Risk Acceptance Approach For Return To Flight , which the Space Shuttle 
Program points to as a response to inquiries regarding risk assessment and risk management. 
The document appears to be intended for the uninitiated reader rather than a being a technical 
document for use by the program. 

The main text of the May 2005 version consists of 41 pages that are essentially a chronology 
of events leading to the current state written more for a general primer than a serious treatise 
on institutional process and rigor necessary for consistent, successful risk management. The 
Residual Risk Matrix contained in an additional 18 pages of Appendix A lists remaining tasks 
or “Objectives” rather than identified areas of risk. The remaining three columns delineating 
“Evidence of Objective Completion,” “Remaining Risk,” and “Acceptance Rationale,” in 
order are populated by items which are frequently vague and require considerable suspension 
of belief to conclude a particular risk acceptable. As an example, under “Remaining Risk” on 
page A-3 the last item states: 

“Although these efforts will in all likelihood reduce the potential for flow of liquid 
nitrogen through the flange and reduce the potential for foam loss in flight, there is 
no quantitative means to demonstrate this as fact. Previous foam divot formation in 
the flange area produced foam debris below the current allowable. NASA has 
considered and accepted this risk.” 

The corresponding “Acceptance Rationale” states simply, and somewhat glibly, “Acceptable 
Risk.” Unfortunately, this raises more questions than it answers, such as: 

How does one conclude reduction, “.. .in all likelihood...”? 

What “.. .previous foam divot formation...”? Flight? Ground Test? 

What is “.. .the current allowable...”? 

How was “.. .allowable.” determined? 

Finally, how did NASA consider and accept the risk? As a follow on, what is the plan to 
reassess or correct if existing risks are accepted? 

Requirements Example 1 

The NSTS 07700 (the top-level specification for the program) requirements are substandard 
in a number of areas: they are not individually numbered to facilitate referencing an 
individual requirement (i.e., there are multiple “shalls” per paragraph); they are often stated in 
an ambiguous and untestable fashion; and there is inconsistent use of terminology such as 
“shall,” “will,” and “must.” Given the 2010 retirement of the Space Shuttle, it does not make 
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sense to go back and correct existing requirements; however, those requirements modified or 
added as part of the return to flight effort and any subsequent requirements changes should 
adhere to industry-standard requirements practices. This includes documenting the 
verification and validation criteria at the same time as the requirement (before implementation 
begins), a practice not in evidence in the requirements documents made available to the RTF 
TG. Additionally, on multiple occasions the Task Group asked about the ability to have an 
auditable trail from Level II (NSTS 07700) requirements and directives down to the 
implementing actions on the floor. The Task Group was informed that the Program 
Configuration Management System did not allow for such an auditable trail. 

Nor does the program seem to know how to change requirements. For example, there is a 
requirement in NSTS 07700 for zero debris “that would jeopardize the flight crew, vehicle, 
mission success, or would adversely impact turnaround operations” (Book X, 3.2.1.2.14). 
After it was determined that the External Tank would continue shedding debris of a 
potentially critical size, the program decided - after 113 flights - they needed to change or 
waive the requirement. The first change was to add a requirement that the External Tank 
could not shed debris that generated impacts larger than 1,500-ft/lbs (NSTS 07700, Book X, 
3.2.1.2.14.4.1). This requirement later turned out to be inadequate since the Orbiter could not 
be certified to withstand impacts that large. In response, a permanent waiver to this Level II 
requirement was proposed stating “This requirement is waived for the External Tank.” 
However, this generated controversy within the program and an alternate proposal was 
brought forward to eliminate the need for any debris waivers by adding an “exception” (see 
Requirements 2) to the top-level NSTS 07700 requirement. The Task Group does not know 
the status of either proposal since the PRCB does not publish minutes of their meetings. As 
late as the second Program DCR (June 2005), program management was attempting to 
establish the mechanism for documenting requirements and exceptions; by this time the 
hardware was on the pad. 

Requirements Example 2 

How do you meaningfully track requirements when you do not understand the definitions of 
programmatic terms? For instance, at the STS-114 Flight Readiness Review, the Space 
Shuttle Program attempted to define the terms “Waiver,” “Deviation” and “Exception.” 
Within the documentation listed, there were 11 definitions for “Waiver,” 7 for “Deviation,” 
and 5 for “Exception;” some definitions were combinations of the terms. Sometimes there 
were multiple definitions for a single term with in one volume of NSTS 07700 - and even 
worse, sometimes within the same paragraph of NSTS 08171! 

Standard definitions for many engineering terms exist in industry and academia; NASA 
should adopt these standard definitions wherever possible and use them consistently. For 
instance, like the CAIB, the Task Group found that the “in-family/out-of-family” designators 
a continuing source of confusion. Unfortunately, NASA seems to place a low priority on 
maintaining standard terms and definitions. The following entry was found in a list of NASA 
Handbooks at Headquarters: “NHB 5300.4(1 G) NASA Assurance Terms and Definitions - 
Has been deleted - Long term plans call for development of a NASA-Standard for 
definitions.” We have no idea when these “long-range plans” will come to fruition. 

Models Example 1 

NASA has in the past maintained certain models in formal requirements documents (e.g., 
NSTS 07700) and employed well-recognized processes for developing and using analytical 
models. However, during the return-to-flight effort, there has been an enormous expenditure 
of time and resources - amounting to tens of millions of dollars - without the discipline of a 
formal development plan, clear objectives, explicit plans for verification and validation, 
thorough outside review, documented ICDs between models, or a good understanding of the 
limitations of analytical systems employing multiple, linked deterministic models. Validation 
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and verification planning has been left to the end of the process rather than the beginning. 
Early peer reviews were limited to the question of appropriateness for the proposed task and 
never reassessed or reconstructed post-development. Even the belated efforts by the NESC are 
not classic peer reviews. Outside peer reviews would highlight, for example, the extreme 
difficulty, if not impossibility, of forming an end-to-end conclusion on the confidence interval 
inherent in any particular result. Even more troubling, in many instances historical flight data 
was not used during the initial stages of model development. 

On several occasions, members from the NESC and RTF TG expressed concern regarding the 
development and use of debris models. We observed that development test data was being 
used rather than verification test data in attempts to verify models. It should be noted that the 
development test data was obtained over widely varying test conditions. Analytical models 
have essentially driven the return-to-flight effort; however, industry and academic standards 
and methods for developing, verifying, and validating the models have not been used. In 
addition, no sensitivity analyses had been conducted and no empirical data from flight history 
had been incorporated in the models or their validation. Suggestions to use flight history, 
probabilistic techniques, and sensitivity analysis were disregarded. A formal request for a 
stand-down to evaluate the completed works was ignored. 

All the while, the External Tank was being modified to meet requirements established by 
preliminary and interim model outputs. In December 2004, a modified External Tank meeting 
these interim requirements was shipped to the Kennedy Space Center with the understanding 
that if the final requirements determined by the modeling effort resulted in smaller debris 
allowables, the next tank in line would be modified to meet the more stringent requirements, a 
so called “trailing tank” concept. For various reasons, the program decided to abandon the 
trailing tank concept before the second tank was shipped to the Kennedy Space Center. 

Models Example 2 

Progress has been made by the ET Project to reduce the risk of critical debris during ascent. 
Many of these changes were made on the basis of debris-flow modeling and transport 
analysis. Initial analysis and simulation of the Orbiter showed that the RCC could withstand 
impacts up to 1,500-foot-pounds, a figure that was turned into a requirement for the ET 
Project. The tools that produced these initial estimates had not been verified or validated, yet 
their output was used to develop and build flight hardware. Further impact testing of actual 
RCC, however, showed that 1,500-foot-pounds are far greater than the RCC can actually 
withstand reliably. This knowledge came too late, and the ET Project had already modified 
External Tanks based on the original 1,500-foot-pound number. 

In an attempt to justify both numbers - the larger number given to the ET Project and the 
lower number for the Orbiter Project - a complex effort was undertaken to develop a 
Capability over Environment (C/E) analysis, using several of the models already being 
developed. In this case, the “capability” is the size and speed of impact the Orbiter can 
withstand, while the “environment” is the amount of debris coming off the External Tank (and 
other sources). Numerically, a value of “1.0” implies the hardware can withstand the 
environment - but just. Normally a factor of safety, often “1.4” in the Space Shuttle Program, 
is required for additional margin. 

The C/E approach was first introduced to the RTF Task Group during the September 2004 
Plenary. The program provided the results of the initial assessment that indicated critical 
debris was a particular size, but admitted that the uncertainties were several orders of 
magnitude on either side. On February 17, 2005, the then-current C/E analysis was presented 
to the program; in almost all cases the C/E was less than 1.0, meaning that the capability of 
the Orbiter to withstand damage was less than the amount of debris in its expected flight 
environment. This analysis had been done using “worst-on-worst” conditions corresponding 
to certification levels; something everybody agreed was unlikely to occur in real life, but in 
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Standard “4 by 3” 
risk chart used by 
the Space Shuttle 
Program. 


accordance with the ground rules laid out when the C/E analysis began. The next day, at the 
Spaceflight Leadership Council meeting, it was presented that if the worst-on-worst C/E was 
less than 1.0, the program would look at best-estimate C/E. 

It should be noted that determining exactly what factor of safety was provided by the models 
is a bit challenging. For instance, each of the component models in the C/E worst-on-worst 
analysis had a factor of safety of 1.4 built into it, therefore a combined C/E of 1.0 in reality 
still had an adequate factor of safety. This became more problematic with the “best-estimate” 
analysis, where estimates of more likely performance (for both the Orbiter and the External 
Tank) were used. Keeping track of the ever-changing differences in inputs between worst-on- 
worst C/E and best-estimate C/E was difficult; there was little agreement in the community on 
what factors should be included in the best-estimate version. 

At the beginning of the Delta Design Verification Review (April 26-27, 2005), the rules stated 
that if the “best-estimate” of Orbiter capability relative to debris environment (C/E) was less 
than 1.5, then the likelihood on the standard program 4x3 risk matrix would be “infrequent,” 

and if 1.5 or greater it would be categorized as 
“remote.” For example, for the L02 intertank 
flange closeout, the best-estimate C/E was 1.1, 
which should have classified the risk as 
“infrequent.” However, many argued that the 
problem was sufficiently well understood that 
it could be put in the “remote” category 
despite its low best-estimate C/E. Others said 
it should be “infrequent” since that is what the 
process dictated, and that it involved “old” 
foam and therefore contained a greater uncertainty. At that point, Space Shuttle Program 
management pronounced that the best-estimate C/E value of 1.5 determining an “infrequent” 
vs. “remote” rating was only a guideline, not a rule. The middle of a design review does not 
seem an appropriate time to be changing the rules. 

The arbitrary nature of the requirements/fulfillment process is demonstrated by the February 
2005 changes in approach (from “worst-on-worst” to “best estimate”) and reduction in factors 
of safety to make the numbers come out right. When asked during the RTF TG March 2005 
Plenary if the tank will change when results from the modeling are finally available, the 
answer was “... no, that’s why we’re changing the models so we don’t have to change the 
tank.” 

The program continued to develop and make decisions on analysis techniques, such as best- 
estimate C/E, which used non-standard approaches. This history of the C/E logic raises 
questions regarding the management of the retum-to-flight effort. Fortunately, this approach 
was abandoned when the Program reluctantly initiated probabilistic analyses on additional 
critical areas at the direction of the new Administrator. Analytical models have essentially 
driven (and delayed) the retum-to-flight effort even though industry and academic standards 
and methods for developing, verifying, and validating the models have not been used. 

Models Example 3 

During the reviews of the probabilistic analysis efforts, requests were made by several people, 
including Task Group members, to clearly state the assumptions going into these models. It 
was not until the end of the 6-week review effort that the assumptions to some of the models 
used for this activity were recorded; for some of the models, no comprehensive set of 
assumptions were ever documented. By their nature, these models are complex and 
sophisticated analysis tools. Therefore, the quality of the original assumptions is important; 
they should be written down and consistently applied. 
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Leadership Example 1 

A clear example of a lack of budgetary restraint was demonstrated by the management of the 
TPS repair projects. For an extended period of time, there were few constraints placed on the 
development teams, and money was spent on the development of almost any idea that was 
proposed. Only when the large-scale RCC rigid overwrap repair effort was finally deemed 
untenable was it removed from the list of options being considered for STS-114. At the 
direction of the Space Shuttle Program, during late 2004 the Orbiter Project Office initiated a 
study to eliminate some of the repair options in an attempt to focus manpower and budget on 
the most promising techniques. This resulted in resources being expended to generate 
proposals, and an evaluation team worked over the winter holidays to develop a 
recommendation on which options to select. Ultimately the Orbiter Project Office brought 
forward two tile repair options and a single RCC repair option to Space Shuttle Program 
management. Nevertheless, six options (two for tile repair and four for RCC repair) were 
actually considered by the program, and only one RCC option was ultimately dropped. 
Surprisingly, although a stated reason for performing the down-select was to reduce 
expenditures, cost estimates were explicitly excluded from the factors used in the decision. 

Several months later, when two cost Change Requests (CR) for continued tile and RCC repair 
development were brought to the PRCB (asking for nearly $100M for the last 5 months of 
FY05), the CR sponsor objected to suggestions that the program needed to consider if this 
was how limited resources should be spent. In the end, the only criteria that determined how 
much would be spent on the two CRs was whether all the money could be spent by the end of 
the fiscal year, not whether this was a wise use of limited program resources. 

A.3 Observations by Mr. Joseph W. Cuzzupoli and Mr. Richard H. Kohrs 

NASA’s aggressive future plans require experienced personnel from both government and 
government contractors. To meet the challenges ahead for the U.S. Space Program, NASA 
would be wise to bring back experienced, ex-NASA employees with development 
engineering expertise to fill the many holes left in the Agency. 

The utilization of operational-type management and engineers made the return to flight of the 
Space Shuttle difficult. Nevertheless, the result was enormously positive for NASA. They got 
there! We are proud of the NASA management and engineering teams for this most 
successful accomplishment. 

A.4 Observations by Dr. Charles C. Daniel 

When performing a post accident investigation, it is of primary importance to be able to 
establish the “root cause “of the failure condition. In the case of the Columbia accident, the 
physical cause was isolated by the CAIB to a release of foam from the bipod ramp of the 
External Tank. However, the exact release mechanism (root cause) for the foam was never 
successfully replicated. The ET Project decided to remove the bipod ramp foam, thus 
eliminating the potential for this specific release; this action did not, however, address the 
release mechanism of other areas of thermal protection system foam applied using similar 
processes. The ET Project established the adhesive/cohesive mechanism as the “most 
probable” failure mode for producing debris release. All of the design and process changes 
implemented were intended to reduce the risk associated with the adhesive/cohesive failure 
mode. Although other failure modes were identified, they were not the focus of the return to 
flight activity. The assumption was made that these failure modes had not occurred on prior 
flights, and therefore would not in the future. Unless the specific failure root cause can be 
established and eliminated, all failure modes must be addressed and closed out. 
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A.5 Observations by Ms. Susan Morrisey Livingstone 

The RTF TG Charter focused specifically on the 15 CAIB return-to-flight recommendations. 
With respect to these 15 recommendations, many NASA residual issues and planned future 
actions remain. In addition, the CAIB had 14 other recommendations, as well as numerous 
other important findings and observations. The NASA Implementation Plan further added yet 
other “raise the bar” actions. Finally, NASA determined that the CAIB report had many 
valuable “lessons learned” applicable to the agency as a whole. NASA needs to capture and 
integrate these lessons learned and planned future actions and determine how they will 
effectively monitor fulfillment and/or reassess and adjust them. 

In terms of the specific CAIB RTF recommendations, I offer the following additional 
supplementary observations. 

1. R3.4-1, 3.4-1, 3.4-3, 6.4-1: In highly complex systems, integration of multiple sources of 
data and the translation of such data into meaningful forms that support decision making 
remain a critical, but challenging requirement, particularly in making time sensitive, 
integrated risk vs. risk trades. Upon RTF of the Shuttle, this is particularly true given the 
enhanced imagery, inspection, and potential repair capabilities post-Columbia. NASA’s 
refinements in its Shuttle risk mitigation and risk management approach, to include the 
future of CSCS/LON, are critical parts of this integrated process. The Space Shuttle 
Program’s development of the OIP/Annex (see section 2.2 of this report) represents 
significant forward progress in providing a framework for such integration, as well as 
providing an integrated risk vs. risk methodology. Continued flight-to-flight verification 
of and refinement in these documents can serve as an important metric of post-RTF 
progress in these areas. Over time, NASA decisions to retain and further improve 
required performance or resolution enhancements in Shuttle imagery and inspection (e.g., 
LDRI and post-OBSS), along with the continued development and training of the thermal 
Protection System Management Working Group and Mission Management Team in their 
use, might also be good metrics to track. 

2. R3.4-1: To fully ensure Mission Management Team pre-launch evaluation of the R3.4-1 
assets, NASA might wish to consider defining minimum requirements for them in the 
Operations and Maintenance Requirements System Document, rather than the Kennedy 
Space Center Program Requirements Document. 

3. R4.2-3: I strongly recommend continued NASA attention to strengthening its quality 
assurance program. The work of the Government Mandatory Inspection Point 
Independent (GMIP) Assessment Team and their January 22, 2004, Independent 
Assessment Final Report provides a good beginning. This CAIB recommendation 
combined with R4.2-5 more than clearly underscored the important need for clarity and 
standardization of processes, standards, and terminology within and between NASA 
elements and programs. 

4. R6.2-1: Pressure for under budgeting and overly aggressive scheduling must be 
recognized and mitigated by senior leadership. As a significant part of this effort, NASA 
needs to address the required size and capability mix of its future workforce, to include 
commensurate leadership and managerial capabilities. Since the most critical part of 
“resources” is human capital, NASA faces a challenge in terms of addressing the skills 
and talents (in-house and outsourced) required to successfully fulfill the Space Shuttle 
Program and transition to the Vision for Space Exploration. As the CAIB noted, the 
Space Shuttle was being treated as an “operational” instead of a “developmental” 
program, and over time, NASA management and workforce was skilled accordingly. 
Based on the Agency’s experience in the return-to-flight effort, NASA will need to 
determine the extent that management and engineering skill sets and processes required 
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of a developmental program have atrophied or been lost and the corrective action needed. 
Such an assessment also needs to address the contractor workforce, to include 
supervisory chains to ensure appropriate direct NASA leadership and managerial 
oversight of critical work functions. 

5. R6.3-1: While our Final Report addresses forward work for the Shuttle MMT, necessary 
coordination between the Space Shuttle Program and the International Space Station 
(ISS) Program remain another “work in progress”. The primary mission of the Space 
Shuttle is to complete assembly and provide logistical support to the ISS. Given this fact, 
it is imperative that effective communication and integration occurs between these two 
organizations. Frequently, pre-flight decisions made by the SSP have an impact on 
planning by the ISSP. Similarly, ISS issues have a direct bearing on SSP operations. 
Although the JPRCB exists to manage this process, NASA needs to determine if it 
adequately provides the overall integration that needs to occur. Additionally, during real¬ 
time mission operations, significant coordination and discussion are required among the 
two flight control and mission management teams relative to anomalies with the Orbiter 
that may affect current and future ISS operations and vice versa. During RTF TG 
observations of MMT simulations, fully effective demonstration of this needed SSP-ISS 
integration activity was not clear. Indeed, for most of the Shuttle MMT simulations over 
the past 2 years, limited involvement by the ISS Program in the MMT simulation training 
was evident. Future MMT training events need to fully exercise and reinforce the 
importance of an integrated Station-Shuttle mindset. 

6. R6.4-1: Given post-RTF remaining work on debris reduction, Orbiter hardening, and 
repair techniques, NASA will need an effective plan for prioritizing such work. At a 
minimum, NASA will need to analyze the costs and benefits (to include risk reduction 
value) of planned future work - and the trades within and between - for further ET debris 
liberation reduction work, further Orbiter hardening phases, and additional work to 
mature tile and RCC repair capabilities. As a part of this analysis, objective success 
criteria for each should be established along with requirements for verification, validation 
and certification. Peer review in this analysis would be helpful, particularly in 
determining potential impacts on flight accepted risk rationale from an STS-114 baseline. 

7. R10.3-1: NASA should determine if use of the full capability of the standardized, high 
resolution cameras would be beneficial for close-out photography. 

A.6 Observations by Mr. James D. Lloyd, ex-officio 

Over the past two years of the RTF TG charter, I believe we have witnessed the coalescence 
of an entire Agency around a single goal in a crises caused by a catastrophic accident that 
killed seven members of the NASA family and destroyed a national resource. Since the 
Columbia accident, NASA has consistently placed safety above regard for cost or schedule in 
our efforts to return the high-performance, yet fragile, Space Shuttle system to flight. At the 
same time, NASA has begun phasing out the Space Shuttle which is scheduled to complete its 
mission of assembling the International Space Station in 2010. 

There are a number of behaviors that stem from NASA’s core values of safety, integrity, 
excellence, and care for the NASA family. Attention to detail is one of the most important. 
This is a trait demanded from the “touch” labor force and technicians when dealing directly 
with aerospace flight hardware; unfortunately, we had to re-leam that it is also required of 
engineers and managers at other levels of the organization. We must continually remind 
ourselves that human space flight is hard, expensive, and risky. But it is worth doing. 

It is likely that as we fly more missions that are successful on the Space Shuttle, there will be 
a temptation to reduce the funding for the Program which could lead to a relaxation in our 
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engineering rigor. At first, it will be fairly easy to deflect these urges to economize by 
pointing to the CAIB report. We must remain vigilant to prevent success from breeding 
complacency, and then failure. This progression is a well-documented phenomenon that is 
repeated for almost any complex system. Today’s strong stance against cutting resources for 
operating successful programs will almost certainly regress. Because of NASA’s “can do” 
spirit, we will likely take on the challenges of fewer resources and constrained schedules to 
meet the goals set for us by our leaders. NASA needs to guard against shortchanging the 
processes that will help us to identify and prevent the next accident. To ensure that we do not 
repeat our past mistakes, we must continue to capture the knowledge that we gain and 
overcome the obstacles presented by problems we encounter as we operate and eventually 
complete the mission of the Space Shuttle. The challenge for NASA and our stakeholders in 
the Space Shuttle Program is to understand the paradox that success will breed new 
challenges and to be wise enough to know that we cannot perform human space flight “on the 
cheap.” This same approach will apply as much to the crew exploration vehicle now being 
conceived. 

With a management team humbled by failure, with a new philosophy for independent 
technical authority (ITA), with a substantial new capability to perform in-depth and 
independent engineering test and analysis (the NASA Engineering and Safety Center), with a 
refortified safety and mission assurance organization, with a new energy and focus for system 
engineering, and with an Aerospace Safety Advisory Panel ready to receive the “battle flag” 
from the Return To Flight Task Group, we believe we already have, or are building in, the 
right amount of tension to counter any significant back-sliding for the next several years. This 
combination of management wisdom and independent thinking may keep us from collectively 
falling back into the dangerous “group think” posture that the CAIB described. We need to 
continue both an environment for healthy dialog and a culture of dissent for each present and 
future program. If we are able to preserve the combination of NASA’s can-do attitude and an 
unflagging attention to the engineering details, we will be able to fulfill the vision for 
exploration while successfully completing the tasks assigned to the Space Shuttle Program. 

A.7 Observations by Lt. Gen. Forrest S. McCartney 

Recovery from a major aerospace accident is always a very painful experience, especially if 
human life is lost. The personnel involved in the investigation and oversight of the recovery 
should be carefully chosen and have experience in related activities (such as aircraft, space 
hardware development, weapons systems development, space operations, underwater naval 
activities, etc). The accident investigation report should be carefully written and focused on 
the root cause of the accident, since the recovery team normally reacts to the 
recommendations in a very aggressive way (which was certainly the case for the Columbia 
accident). Any oversight group (such as the RTF TG) has the responsibility to evaluate the 
recovery team’s efforts from a very difficult viewpoint. A phrase sometimes used is “to call 
balls and strikes” or, said another way, to focus on the results of the recovery team’s actions - 
not the motions of the recovery team in implementing their recovery actions. 

While some of us might have approached the recovery process in a different way, the end 
result is what counts. In my opinion, The NASA Headquarters leadership and Space Shuttle 
Program Office have done their best to implement the actions they believe will lead to a safe 
return to flight. The entire Space Shuttle work force is dedicated to accomplishing the work 
necessary for safely returning to flight. They are to be congratulated on their efforts. 

A.8 Observations by Dr. Rosemary O’Leary 

The CAIB criticized NASA for an organization culture that tends to suppress dissent. Indeed, 
the issue of how NASA managers handle dissent within the organization permeated many of 
the RTF TG items presented in this report. To be more specific, the more significant challenge 
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facing NASA is a form of dissent suppression called “groupthink.” Groupthink is an insular 
decision-making process in which decision makers are so wedded to the same assumptions 
and beliefs, that they ignore, discount, or even ridicule information to the contrary (Janis 
1972). Symptoms of groupthink include overestimations of the group’s power and morality, 
closed-mindedness, and pressure toward uniformity. 

As former NASA Administrator Sean O’Keefe put it, the biggest battles at NASA are not 
between the Agency and Congress, as some might think. They’re between and among the 
diverse disciplinary groups who work in parallel “silos.” Sometimes diverse opinions and 
judgments are crushed or shouted down, but they are more often automatically deemed 
improbable or ignored. The dismissing of other viewpoints happens so quickly and is 
sometimes so subtle that as a leader it is very tough to address. 

The opinions and judgments developed by individual teams often follow a different logic path 
than other teams. Hence, when another viewpoint is expressed by an “outsider” or someone 
questions the result, NASA employees often dismiss the opinions offered because they don’t 
take the time to understand the rationale or path taken. More troublesome, as the Integrated 
Vehicle Assessment Sub-Panel observed during fact-finding on March 30, 2005, sometimes 
the parallel silos are so poorly integrated that no discussion or connection ensues. Even worse 
is what the task group discussed at that same meeting: “malicious compliance” where lip 
service is given to gathering different viewpoints and analyses, yet it is not done in reality. 

Despite these challenges, many NASA employees at all levels are quick to dismiss the 
importance of an improved organization culture and the need for organizational change. Thus, 
one of the problems facing the new NASA Administrator, Mike Griffin, is how to change the 
culture of the Agency from one of malicious compliance, parallel silos, and lack of horizontal 
communication where different ideas are quickly dismissed, to one that embraces a diversity 
of views and uses those differing viewpoints for constructive change. 

My work as a member of the RTF TG over the last two years coincided serendipitously with 
the writing of my forthcoming book on dissent in organizations (O’Leary, 2006). As a part of 
this effort, in 2005, I surveyed some members of the RTF TG, members of the National 
Academy of Public Administration (NAPA - an independent, non-partisan organization 
chartered by Congress to assist federal, state, and local governments in improving their 
effectiveness, efficiency, and accountability), and alumni of the Maxwell School of Syracuse 
University (the oldest - and top ranked - school of public affairs in the country). I asked them 
about the value of dissent in organizations, but more importantly how to manage dissent. Of 
the 216 current and former managers who responded, 213 indicated that dissent, when 
managed properly, was not only positive, but essential to a healthy organization. 

From these 216 surveys came dozens of suggestions for how to manage dissent and how to 
address groupthink in NASA. I present some of them here with the hope of furthering the 
discussion about dissent at NASA: 

1. Embrace dissent. This means inviting a diversity of opinion from the people 
around you. Never surround yourself with people who are just like you. 

2. Always insist upon someone voicing the dissenting opinion. Always. 

3. Create an organization culture that accepts, welcomes, and encourages candid 
dialogue and debate. Cultivate a questioning attitude by encouraging staff to 
challenge the assumptions and actions of the organization. 

4. Set up a regular process to receive dissent. Be accessible. Have an open door 
policy. Insist that employees come to you first. Allow employees to dissent in 
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civil discourse in group meetings or in private through memos or conversations: 
some people who have great ideas that challenge the status quo do not like to 
publicly display them. 

5. Implement two-way evaluations where managers evaluate employees and 
employees evaluate managers. Managers who are involved in groupthink do so 
without realizing it. Often times lower level employees can see it, label it, and 
draw attention to it. 

6. Make available options for addressing all types of problems to all people in the 
workplace, including employees, supervisors, professionals, and managers. A 
systemic structure that coordinates and supports multiple access points and 
multiple options and integrates effective conflict management practices into 
daily organizational operations should be provided. Persons who are 
knowledgeable and trustworthy for approaching with advice about a conflict or 
the system should be easily identified. 

7. Encourage the resolution of conflict and collaborative problem solving at the 
lowest level through direct discussion and negotiation. 

8. Listen. The hallmark of a strong leader is to be a good listener. Don’t just hear 
the dissent, but to probe it, evaluate it, challenge the underpinnings (without 
discarding it out of hand), and make a reasoned decision on whether the dissent 
has a viable position. 

9. Understand the formal and the informal organizations. The informal 
organization, generally, is that which may not manifest itself on an organization 
chart or in official documents. Examples include histories and connections 
between and among employees, traditions, power bases, and how the 
organization has learned to cope with challenges. The informal organization 
may be more difficult to identify than the formal, but it is often the environment 
within which dissent grows and develops. 

10. Separate the people from the problem. Approach the issues on the merits and 
people as human beings. Fisher, Ury and Patton (1991) reinforce this in their 
best selling book Getting to Yes where they advise to separate the relationship 
from the substance, deal directly with the people problem, and strive to solve 
collaboratively the problem at hand. 

11. Use peer review. Experts such as the National Science Foundation, NAPA, 
FAC A committees, consultants, and university professors can help sort out the 
diversity of analyses and opinions that naturally arise from a healthy 
organization. 

12. Allow the process that encourages diversity views enough time to fully run its 
course, but create dissent boundaries and know when to stop. Dissent is 
important, but a leader has to know when to say “enough.” Then sit down with 
staff and explain how and why you made your decision. 

Dissent exists in every organization to some degree. The point is to create and promote a 
workplace climate in which dissent is constructively addressed and resolved, and groupthink 
is kept in check. NASA needs to learn how to tap into the potentially insightful, creative ideas 
and energy of dissenters: They may be canaries in the coal mine telling the leaders that 
something is awry. 
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These ideas of those I surveyed are in keeping with much of the classic and current literature 
in organization theory and management. Slater and Bennis (2003), for example, espouse more 
democratic organizations that have the following characteristics: 

• Full and free communication, regardless of rank and power. 

• A reliance on consensus, rather than the more customary forms of coercion or 
compromise to manage conflict. 

• The idea that influence is based on technical competence and knowledge rather 
than on the vagaries of personal whims or prerogatives of power. 

• An atmosphere that permits and even encourages emotional expression as well 
as task-oriented acts. 

• A basically human bias, one that accepts the inevitability of conflict between the 
organization and the individual, but which is willing to cope with and mediate 
this conflict on rational grounds. 

A NASA organization culture that counteracts groupthink by welcoming “diversity thinking” 
is essential. Kingdon (2003: p. 183) sees the “free-form process” triggered by diversity 
thinking as promoting creativity and an opportunity for new and innovative ideas to emerge. 
Diversity thinking yields entrepreneurs who often act as brokers, negotiating among people, 
yielding couplings that might never have occurred in a more structured setting. These 
couplings, or linkages of workers outside their immediate workgroups, often yield new ideas 
(Erard, 2004). 

Scholars who have empirically studied career public servants routinely find that they are 
largely highly principled, hard working, responsive, and functioning professionals. NASA is 
no exception. If NASA can continue to work on improving its organization culture to embrace 
dissent and banish groupthink, it has a fighting chance of remaining one of our premier public 
organizations. 
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A.9 Observations by Mr. Seymour Z. Rubenstein 

During the recovery from the Columbia accident, it was apparent that NASA was going to 
require a significant number of development engineers to accomplish the recommendations of 
the CAIB. The dominant makeup of the technical force was test, and flight and ground 
operations personnel. This is true at NASA and its major contractors. During the investigation 
period, a great deal of help was derived from “the graybeards.” However, when it came time 
to develop the fixes, systems engineers, development engineers, manufacturing engineers, and 
contractors with development experience were in short supply. As a result, some of the work 
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appeared more bottom-driven and without full development rigor. In addition, schedules were 
often underestimated due to a lack of understanding of the scope and timeline of development 
activities. 

Another reason these conditions arise is that senior program management is constantly 
pressing to lower cost by reducing the higher-priced technical personnel and replacing 
experienced engineers with recent graduates. 

As we resume the Space Shuttle flights it is important to make sure the right mix of technical 
personnel is maintained. A significant amount of flight test data will be generated during 
STS-114, requiring analysis and resulting in action plans for future work; additional fixes are 
yet to be completed. There must be an associated manpower and management plan through 
the remainder of the Space Shuttle Program. NASA should also consider the best contractual 
arrangements for finishing the program and assuring the proper skill mix and knowledge are 
transferred to the development of the next manned vehicle. 

A.10 Observations by Mr. Robert B. Sieck 

The CAIB report contained much information regarding issues with the culture in NASA and 
the Space Shuttle Program. The section on the performance of the MMT during the STS-107 
mission clearly characterized the issue, and the accident board offered appropriate findings 
and recommendations. 

The RTF TG members spent considerable time in the past two years observing - and 
participating - in Space Shuttle Program activities. In addition to numerous presentations 
from NASA and contractor management, the RTF TG was able witness the working level 
personnel performing their tasks. This included discussions during technical panels and 
working groups, problem resolution teams, control boards, and “hands-on” floor work. In 
general, there was high sensitivity among the participants to be thorough, attentive to details, 
encourage participation, and to take whatever additional time was necessary to collect 
relevant information before proceeding. It was encouraging to see that the engineers, 
technicians, and inspectors value the attention to detail as their work ethnic. 

The CAIB noted that “NASA’s safety culture has become reactive, complacent, and 
dominated by unjust optimism” (p. 180). NASA has undertaken initiatives to correct this, 
particularly in their management processes. However, the RTF TG observed that the 
“working level” culture is already consistent with what is required, and should continue to be 
fostered, for human space flight programs. 


Discovery at 
Edwards Air Force 
Base, California, 
after the completion 
of the STS-114 
mission. 
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Discovery lifts-off 
from the Kennedy 
Space Center as 
STS-114. 
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Discovery during 
ascent with both 
Solid Rocket 
Boosters and all 
three Space Shuttle 
Main Engines at full 
throttle. 
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